CVE-2023-20860

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.

References

Affected packages

Debian:11 / libspring-java

Package

Name: libspring-java
Purl: pkg:deb/debian/libspring-java?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.3.30-1

4.3.30-2

4.3.30-3

Ecosystem specific

{
    "urgency": "unimportant"
}

Debian:12 / libspring-java

Package

Name: libspring-java
Purl: pkg:deb/debian/libspring-java?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.3.30-2

4.3.30-3

Ecosystem specific

{
    "urgency": "unimportant"
}

Debian:13 / libspring-java

Package

Name: libspring-java
Purl: pkg:deb/debian/libspring-java?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.3.30-2

4.3.30-3

Ecosystem specific

{
    "urgency": "unimportant"
}

Git / github.com/spring-projects/spring-framework

Affected ranges

Type: GIT
Repo: https://github.com/spring-projects/spring-framework
Events: Introduced

5acffaa72da10ba42fe547eeea44d8615cbf99b9

Fixed

3540029931c957b646fe219e6c3e713f044ee767