Integer overflow in Spring Security - CVE-2022-22976

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU63342

Integer overflow in Spring Security - CVE-2022-22976

Published: May 17, 2022 / Updated: May 17, 2022


Vulnerability identifier: #VU63342
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-22976
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in BCrypt class with the maximum work factor (31) for BCryptPasswordEncoder. The encoder does not perform any salt rounds, which weakens encryption capabilities of the software.


Affected software

Spring Security
IBM i Modernization Engine for Lifecycle Integration
Storage Copy Data Management
Storage Protect Plus Server
Bosh Release for the UAA
Cloud Foundry UAA
IBM Process Mining
IBM Cloud Pak for Business Automation
jenkins (Red Hat package)
jenkins-2-plugins (Red Hat package)
IBM InfoSphere Information Server

How to mitigate CVE-2022-22976

Install updates from vendor's website.

Spring Security - addressed in versions 5.5.7, 5.6.4
IBM i Modernization Engine for Lifecycle Integration - update to 1.0.1
Bosh Release for the UAA - update to 75.20.0
Cloud Foundry UAA - update to 75.20.0
IBM Process Mining - update to 1.14.1
Storage Copy Data Management - update to 2.2.23.0
jenkins (Red Hat package) - update to 2.401.1.1686831596-3.el8
jenkins-2-plugins (Red Hat package) - update to 4.11.1686831822-1.el8
Storage Protect Plus Server - update to 10.1.16.1
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.24, 23.0.1.2

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins