CVE-2023-20862: Medium severity VMware Spring Security vulnerability
In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.springframework.security:spring-security-coreto a version that resolves this vulnerability.Fixed in 6.0.3 - Upgrade
Upgrade
maven/org.springframework.security:spring-security-coreto a version that resolves this vulnerability.Fixed in 5.8.3 - Upgrade
Upgrade
maven/org.springframework.security:spring-security-coreto a version that resolves this vulnerability.Fixed in 5.7.8 - Upgrade
Upgrade
redhat/spring-securityto a version that resolves this vulnerability.Fixed in 5.7.8 - Upgrade
Upgrade
redhat/spring-securityto a version that resolves this vulnerability.Fixed in 5.8.3 - Upgrade
Upgrade
redhat/spring-securityto a version that resolves this vulnerability.Fixed in 6.0.3 - Upgrade
Upgrade
Spring Securityto a version that resolves this vulnerability.Fixed in 5.7.8 - Upgrade
Upgrade
Spring Securityto a version that resolves this vulnerability.Fixed in 5.8.3 - Upgrade
Upgrade
Spring Securityto a version that resolves this vulnerability.Fixed in 6.0.3 - Compensating control
Apply the mitigation mentioned in the referenced Spring Security advisory for CVE-2023-20862 (Spring Security logout does not properly clean the security context when using serialized versions), since logout may not clear authentication after logout.
Event History
Frequently Asked Questions
What is CVE-2023-20862?
CVE-2023-20862 is a vulnerability in Spring Security versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3 that affects the logout support feature.
How does CVE-2023-20862 impact Spring Security?
CVE-2023-20862 impacts Spring Security by not properly cleaning the security context during logout if using serialized versions, and by not allowing saving an empty security context to the Http.
What is the severity of CVE-2023-20862?
CVE-2023-20862 has a severity keyword of 'medium' and a CVSS severity value of 6.3.
How can I fix CVE-2023-20862?
To fix CVE-2023-20862, you should upgrade to Spring Security versions 5.7.8, 5.8.3, or 6.0.3.
Where can I find more information about CVE-2023-20862?
You can find more information about CVE-2023-20862 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-20862), [Spring Security](https://spring.io/security/cve-2023-20862), [Netapp Advisory](https://security.netapp.com/advisory/ntap-20230526-0002/).