Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Spring_security | Pivotal_software | 5.2.0 (including) | 5.2.4 (excluding) |
| Spring_security | Pivotal_software | 5.3.0 (including) | 5.3.2 (excluding) |
| Spring_security | Vmware | 4.2.0 (including) | 4.2.16 (excluding) |
| Spring_security | Vmware | 5.0.0 (including) | 5.0.16 (excluding) |
| Spring_security | Vmware | 5.1.0 (including) | 5.1.10 (excluding) |
| Libspring-security-2.0-java | Ubuntu | trusty | * |