Maven/org.springframework.security:spring-security-bom CVE-2021-22112: high 8.8, EPSS 3.29%
Privilege escalation in spring security
Action: Upgrade org.springframework.security:spring-security-bom to 5.2.9 (5.2.x), 5.3.8 (5.3.x) or 5.4.4 (5.4.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.4.0 | 5.4.4 | - |
| 5.3.0 | 5.3.8 | - |
| 0 | 5.2.9 | - |
Fixed versions
| 5.4.4 | 5.3.8 | 5.2.9 |
Sources
- osv: GHSA-gq28-h5vg-8prx
- https://nvd.nist.gov/vuln/detail/CVE-2021-22112
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.jenkins.io/security/advisory/2021-02-19
- https://tanzu.vmware.com/security/cve-2021-22112
- https://lists.apache.org/thread.html/redbd004a503b3520ae5746c2ab5e93fd7da807a8c128e60d2002cd9b@%3Cissues.nifi.apache.org%3E
- https://lists.apache.org/thread.html/ra6389b1b82108a3b6bbcd22979f7665fd437c2a3408c9509a15a9ca1@%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/ra53677224fe4f04c2599abc88032076faa18dc84b329cdeba85d4cfc@%3Cpluto-scm.portals.apache.org%3E
- https://lists.apache.org/thread.html/r89aa1b48a827f5641310305214547f1d6b2101971a49b624737c497f@%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/r413e380088c427f56102968df89ef2f336473e1b56b7d4b3a571a378@%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/r390783b3b1c59b978131ac08390bf77fbb3863270cbde59d5b0f5fde@%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/r3868207b967f926819fe3aa8d33f1666429be589bb4a62104a49f4e3@%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/r37423ec7eea340e92a409452c35b649dce02fdc467f0b3f52086c177@%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/r2cb05e499807900ba23e539643eead9c5f0652fd271f223f89da1804@%3Cpluto-scm.portals.apache.org%3E
- https://lists.apache.org/thread.html/r163b3e4e39803882f5be05ee8606b2b9812920e196daa2a82997ce14@%3Cpluto-dev.portals.apache.org%3E
- https://github.com/spring-projects/spring-security/releases/tag/5.4.4
- https://github.com/spring-projects/spring-security
- http://www.openwall.com/lists/oss-security/2021/02/19/7
CVE-2021-22112 · published · modified · JSON