Signature Wrapping Vulnerability with spring-security-saml2-service-provider (Spring by VMware Spring Security)
At a glance
- Source
- NVD
- EPSS
- EPSS 1.20 % · percentile 68 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- pivotal
- NVD status
- Modified
Description
Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid.
Weaknesses (CWE)
- CWE-347 — Improper Verification of Cryptographic Signature
References
- https://lists.apache.org/thread.html/r73af928cf64bebf78b7fa4bc56a5253273ec7829f5f5827f64c72fc7%40%3Cissues.servicemix.apache.org%3E
- https://lists.apache.org/thread.html/rd99601fbca514f214f88f9e53fd5be3cfbff05b350c994b4ec2e184c%40%3Cdev.geode.apache.org%3E
- https://lists.apache.org/thread.html/ra19a4e7236877fe12bfb52db07b27ad72d9e7a9f5e27bba7e928e18a%40%3Cdev.geode.apache.org%3E
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://tanzu.vmware.com/security/cve-2020-5407
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-48rw-j489-928m — Signature wrapping vulnerability in Spring Security
European references
- ENISA EUVD · EUVD-2020-0457
- GCVE · GCVE-0-2020-5407
Affected configurations (NVD CPE)
cpe:2.3:a:pivotal_software:spring_security:*:*:*:*:*:*:*:*≥ 5.2.0 < 5.2.4cpe:2.3:a:pivotal_software:spring_security:*:*:*:*:*:*:*:*≥ 5.3.0 < 5.3.2
Affected products
| Product | Versions |
|---|---|
| Spring by VMware · Spring Security | affected 5.2 < 5.2.4 ; affected 5.3 < 5.3.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |