GHSA-mg83-c7gq-rv5c

Suggest an improvement
Source
https://github.com/advisories/GHSA-mg83-c7gq-rv5c
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-mg83-c7gq-rv5c/GHSA-mg83-c7gq-rv5c.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-mg83-c7gq-rv5c
Aliases
  • CVE-2025-22228
Downstream
Related
Published
2025-03-20T06:31:09Z
Modified
2025-04-26T01:21:30.226686Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Spring Security Does Not Enforce Password Length
Details

BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

Database specific 
{
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-287",
        "CWE-521"
    ],
    "nvd_published_at": "2025-03-20T06:15:23Z",
    "github_reviewed_at": "2025-03-20T18:19:20Z",
    "github_reviewed": true
}
References

Affected packages

Maven

org.springframework.security:spring-security-crypto

Package

Name
org.springframework.security:spring-security-crypto
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.security/spring-security-crypto

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.3.0
Fixed
6.3.8

Affected versions

6.*

6.3.0
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
6.3.6
6.3.7

org.springframework.security:spring-security-crypto

Package

Name
org.springframework.security:spring-security-crypto
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.security/spring-security-crypto

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.4.0
Fixed
6.4.4

Affected versions

6.*

6.4.0
6.4.1
6.4.2
6.4.3

org.springframework.security:spring-security-crypto

Package

Name
org.springframework.security:spring-security-crypto
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.security/spring-security-crypto

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.2.10

Affected versions

6.*

6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.2.5
6.2.6
6.2.7
6.2.8

Database specific

last_known_affected_version_range

"<= 6.2.9"

org.springframework.security:spring-security-crypto

Package

Name
org.springframework.security:spring-security-crypto
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.security/spring-security-crypto

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.1.0
Fixed
6.1.14

Affected versions

6.*

6.1.0
6.1.1
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.1.8
6.1.9

Database specific

last_known_affected_version_range

"<= 6.1.13"

org.springframework.security:spring-security-crypto

Package

Name
org.springframework.security:spring-security-crypto
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.security/spring-security-crypto

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.0.16

Affected versions

6.*

6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.0.8

Database specific

last_known_affected_version_range

"<= 6.0.15"

org.springframework.security:spring-security-crypto

Package

Name
org.springframework.security:spring-security-crypto
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.security/spring-security-crypto

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.8.0
Fixed
5.8.18

Affected versions

5.*

5.8.0
5.8.1
5.8.2
5.8.3
5.8.4
5.8.5
5.8.6
5.8.7
5.8.8
5.8.9
5.8.10
5.8.11
5.8.12
5.8.13
5.8.14
5.8.15
5.8.16

Database specific

last_known_affected_version_range

"<= 5.8.17"

org.springframework.security:spring-security-crypto

Package

Name
org.springframework.security:spring-security-crypto
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.security/spring-security-crypto

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.7.16

Affected versions

3.*

3.1.0.RELEASE
3.1.1.RELEASE
3.1.2.RELEASE
3.1.3.RELEASE
3.1.4.RELEASE
3.1.5.RELEASE
3.1.6.RELEASE
3.1.7.RELEASE
3.2.0.RELEASE
3.2.1.RELEASE
3.2.2.RELEASE
3.2.3.RELEASE
3.2.4.RELEASE
3.2.5.RELEASE
3.2.6.RELEASE
3.2.7.RELEASE
3.2.8.RELEASE
3.2.9.RELEASE
3.2.10.RELEASE

4.*

4.0.0.RELEASE
4.0.1.RELEASE
4.0.2.RELEASE
4.0.3.RELEASE
4.0.4.RELEASE
4.1.0.RELEASE
4.1.1.RELEASE
4.1.2.RELEASE
4.1.3.RELEASE
4.1.4.RELEASE
4.1.5.RELEASE
4.2.0.RELEASE
4.2.1.RELEASE
4.2.2.RELEASE
4.2.3.RELEASE
4.2.4.RELEASE
4.2.5.RELEASE
4.2.6.RELEASE
4.2.7.RELEASE
4.2.8.RELEASE
4.2.9.RELEASE
4.2.10.RELEASE
4.2.11.RELEASE
4.2.12.RELEASE
4.2.13.RELEASE
4.2.14.RELEASE
4.2.15.RELEASE
4.2.16.RELEASE
4.2.17.RELEASE
4.2.18.RELEASE
4.2.19.RELEASE
4.2.20.RELEASE

5.*

5.0.0.RELEASE
5.0.1.RELEASE
5.0.2.RELEASE
5.0.3.RELEASE
5.0.4.RELEASE
5.0.5.RELEASE
5.0.6.RELEASE
5.0.7.RELEASE
5.0.8.RELEASE
5.0.9.RELEASE
5.0.10.RELEASE
5.0.11.RELEASE
5.0.12.RELEASE
5.0.13.RELEASE
5.0.14.RELEASE
5.0.15.RELEASE
5.0.16.RELEASE
5.0.17.RELEASE
5.0.18.RELEASE
5.0.19.RELEASE
5.1.0.RELEASE
5.1.1.RELEASE
5.1.2.RELEASE
5.1.3.RELEASE
5.1.4.RELEASE
5.1.5.RELEASE
5.1.6.RELEASE
5.1.7.RELEASE
5.1.8.RELEASE
5.1.9.RELEASE
5.1.10.RELEASE
5.1.11.RELEASE
5.1.12.RELEASE
5.1.13.RELEASE
5.2.0.RELEASE
5.2.1.RELEASE
5.2.2.RELEASE
5.2.3.RELEASE
5.2.4.RELEASE
5.2.5.RELEASE
5.2.6.RELEASE
5.2.7.RELEASE
5.2.8.RELEASE
5.2.9.RELEASE
5.2.10.RELEASE
5.2.11.RELEASE
5.2.12.RELEASE
5.2.13.RELEASE
5.2.14.RELEASE
5.2.15.RELEASE
5.3.0.RELEASE
5.3.1.RELEASE
5.3.2.RELEASE
5.3.3.RELEASE
5.3.4.RELEASE
5.3.5.RELEASE
5.3.6.RELEASE
5.3.7.RELEASE
5.3.8.RELEASE
5.3.9.RELEASE
5.3.10.RELEASE
5.3.11.RELEASE
5.3.12.RELEASE
5.3.13.RELEASE
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.4.7
5.4.8
5.4.9
5.4.10
5.4.11
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.6.0
5.6.1
5.6.2
5.6.3
5.6.4
5.6.5
5.6.6
5.6.7
5.6.8
5.6.9
5.6.10
5.6.11
5.6.12
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
5.7.10
5.7.11
5.7.12
5.7.13
5.7.14

Database specific

last_known_affected_version_range

"<= 5.7.15"