{"action":"Upgrade org.springframework.security:spring-security-core to 5.5.7 (5.5.x) or 5.6.4 (5.6.x) or later.","affected":[{"fixed":"5.5.7","introduced":"5.2.0.RELEASE"},{"fixed":"5.6.4","introduced":"5.6.0"}],"component":"org.springframework.security:spring-security-core","cve_ids":["CVE-2022-22976"],"ecosystem":"Maven","epss":0.02344,"exploited":false,"fixed_versions":["5.5.7","5.6.4"],"ghsa_id":"GHSA-wx54-3278-m5g4","id":"tcs_01M5N9HCB3AQA2HGJYXKV1M62R","modified_at":"2024-06-13T22:00:44.940574Z","published_at":"2022-05-20T00:00:38Z","references":["https://osv.dev/vulnerability/GHSA-wx54-3278-m5g4","https://nvd.nist.gov/vuln/detail/CVE-2022-22976","https://github.com/spring-projects/spring-security/commit/388a7b62b906bd56deadb7ca45248fa1a63bdf12","https://github.com/spring-projects/spring-security/commit/a40f73521c0dd88b879ff6165d280e78bdf8154f","https://github.com/spring-projects/spring-security","https://security.netapp.com/advisory/ntap-20220707-0003","https://tanzu.vmware.com/security/cve-2022-22976","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-wx54-3278-m5g4","url":"https://osv.dev/vulnerability/GHSA-wx54-3278-m5g4"}],"summary":"Integer overflow in BCrypt class in Spring Security"}