CVE-2022-22976

NameCVE-2022-22976
DescriptionSpring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libspring-security-2.0-java (PTS)jessie, jessie (lts)2.0.7.RELEASE-3+deb8u2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libspring-security-2.0-javasourcejessie(unfixed)end-of-life
libspring-security-2.0-javasource(unstable)(unfixed)
Search for package or bug name: Reporting problems