[GHSA-wx54-3278-m5g4] Integer overflow in BCrypt class in Spring Security

[SunBK201]

Updates

• Affected products

Comments
According to Patch, this vulnerability was introduced from 5.2.0.RELEASE.

[shelbyc]

Hi @SunBK201, I looked into the history of the file BCrypt.java and saw that most of the code changed in fix commit spring-projects/spring-security@a40f735 was added in version 3.1.0.RELEASE, specifically spring-projects/spring-security@8565116. Are there any changes to BCrypt.java that occurred in 5.2.0.RELEASE that lead you to believe 5.2.0.RELEASE is the first vulnerable version?

[SunBK201]

According to spring-projects/spring-security@a40f735, vulnerable method crypt_raw in 5.1.13. Vulnerability statement rounds = 1 << log_rounds; does not exist in 5.1.13, induceing commit: spring-projects/spring-security@388a7b6 in 5.2.0

[shelbyc]

Hi @SunBK201, thank you for showing me the commit that introduced rounds = 1 << log_rounds;! After comparing spring-projects/spring-security@388a7b6 and spring-projects/spring-security@a40f735, I agree that it makes sense to set 5.2.0.RELEASE as the minimum vulnerable version.

[advisory-database]

Hi @SunBK201! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!