Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS14ODczLTZyZ2MtOTRqY84AAy4e

Spring Security logout not clearing security context

In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.

Permalink: https://github.com/advisories/GHSA-x873-6rgc-94jc
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14ODczLTZyZ2MtOTRqY84AAy4e
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 1 year ago
Updated: 5 months ago


CVSS Score: 6.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Identifiers: GHSA-x873-6rgc-94jc, CVE-2023-20862
References: Blast Radius: 29.3

Affected Packages

maven:org.springframework.security:spring-security-core
Dependent packages: 1,940
Dependent repositories: 44,289
Downloads:
Affected Version Ranges: >= 6.0.0, < 6.0.3, >= 5.8.0, < 5.8.3, >= 5.7.0, < 5.7.8
Fixed in: 6.0.3, 5.8.3, 5.7.8
All affected versions: 5.7.0, 5.7.1, 5.7.2, 5.7.3, 5.7.4, 5.7.5, 5.7.6, 5.7.7, 5.8.0, 5.8.1, 5.8.2, 6.0.0, 6.0.1, 6.0.2
All unaffected versions: 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 5.4.0, 5.4.1, 5.4.2, 5.4.3, 5.4.4, 5.4.5, 5.4.6, 5.4.7, 5.4.8, 5.4.9, 5.4.10, 5.4.11, 5.5.0, 5.5.1, 5.5.2, 5.5.3, 5.5.4, 5.5.5, 5.5.6, 5.5.7, 5.5.8, 5.6.0, 5.6.1, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.6.10, 5.6.11, 5.6.12, 5.7.8, 5.7.9, 5.7.10, 5.7.11, 5.7.12, 5.8.3, 5.8.4, 5.8.5, 5.8.6, 5.8.7, 5.8.8, 5.8.9, 5.8.10, 5.8.11, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.1.0, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.2.0, 6.2.1, 6.2.2, 6.2.3