Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS14ODczLTZyZ2MtOTRqY84AAy4e
Spring Security logout not clearing security context
In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.
Permalink: https://github.com/advisories/GHSA-x873-6rgc-94jcJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14ODczLTZyZ2MtOTRqY84AAy4e
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 1 year ago
Updated: 5 months ago
CVSS Score: 6.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Identifiers: GHSA-x873-6rgc-94jc, CVE-2023-20862
References:
- https://nvd.nist.gov/vuln/detail/CVE-2023-20862
- https://spring.io/security/cve-2023-20862
- https://security.netapp.com/advisory/ntap-20230526-0002/
- https://github.com/advisories/GHSA-x873-6rgc-94jc
Affected Packages
maven:org.springframework.security:spring-security-core
Dependent packages: 1,940Dependent repositories: 44,289
Downloads:
Affected Version Ranges: >= 6.0.0, < 6.0.3, >= 5.8.0, < 5.8.3, >= 5.7.0, < 5.7.8
Fixed in: 6.0.3, 5.8.3, 5.7.8
All affected versions: 5.7.0, 5.7.1, 5.7.2, 5.7.3, 5.7.4, 5.7.5, 5.7.6, 5.7.7, 5.8.0, 5.8.1, 5.8.2, 6.0.0, 6.0.1, 6.0.2
All unaffected versions: 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 5.4.0, 5.4.1, 5.4.2, 5.4.3, 5.4.4, 5.4.5, 5.4.6, 5.4.7, 5.4.8, 5.4.9, 5.4.10, 5.4.11, 5.5.0, 5.5.1, 5.5.2, 5.5.3, 5.5.4, 5.5.5, 5.5.6, 5.5.7, 5.5.8, 5.6.0, 5.6.1, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.6.10, 5.6.11, 5.6.12, 5.7.8, 5.7.9, 5.7.10, 5.7.11, 5.7.12, 5.8.3, 5.8.4, 5.8.5, 5.8.6, 5.8.7, 5.8.8, 5.8.9, 5.8.10, 5.8.11, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.1.0, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.2.0, 6.2.1, 6.2.2, 6.2.3