REDHAT-BUG-2353507: High severity Spring Spring Security vulnerability
Published Mar 20, 2025
·Updated
BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.
Affected Software
1 affected component
Spring Spring Security
Event History
Mar 20, 2025
Data Sourced
via Red Hat·06:01 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of REDHAT-BUG-2353507?
The severity of REDHAT-BUG-2353507 is considered high due to its potential to allow unauthorized access.
2
How do I fix REDHAT-BUG-2353507?
To fix REDHAT-BUG-2353507, update to the latest version of the affected software that addresses this vulnerability.
3
What are the implications of REDHAT-BUG-2353507?
The implications of REDHAT-BUG-2353507 include possible authentication bypass for users with long passwords.
4
Who is affected by REDHAT-BUG-2353507?
Users and applications utilizing BCryptPasswordEncoder for password verification are affected by REDHAT-BUG-2353507.
5
What is the nature of the flaw in REDHAT-BUG-2353507?
The flaw in REDHAT-BUG-2353507 lies in the method BCryptPasswordEncoder.matches incorrectly validating long passwords.