REDHAT-BUG-1728993: High severity Pivotal Spring Security vulnerability
Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null".
External References:
https://pivotal.io/security/cve-2019-11272
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1728993?
The severity of REDHAT-BUG-1728993 is classified as high due to the potential of exposing user credentials.
How do I fix REDHAT-BUG-1728993?
To fix REDHAT-BUG-1728993, users should upgrade to Spring Security version 4.2.13 or later.
What are the affected versions in REDHAT-BUG-1728993?
REDHAT-BUG-1728993 affects Spring Security versions from 4.2.0 to 4.2.12.
What is PlaintextPasswordEncoder in REDHAT-BUG-1728993?
PlaintextPasswordEncoder is an encoding mechanism in Spring Security that supports plain text passwords, which is vulnerable if not properly configured.
Is REDHAT-BUG-1728993 related to user security?
Yes, REDHAT-BUG-1728993 is directly related to user security as it can lead to the exposure of user passwords.