Multiple vulnerabilities in VMware Spring Security

Published: 2020-06-01

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2020-5408 CVE-2020-5407
CWE-ID	CWE-330 CWE-347
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Spring Security Server applications / Frameworks for developing and running applications
Vendor	VMware, Inc

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Use of insufficiently random values

EUVDB-ID: #VU28463

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-5408

CWE-ID: CWE-330 - Use of Insufficiently Random Values

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the affected software uses a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A remote authenticated attacker can derive the unencrypted values using a dictionary attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Spring Security: 4.2.0 - 5.3.1

External links

http://tanzu.vmware.com/security/cve-2020-5408
http://github.com/spring-projects/spring-security/issues/8317
http://github.com/spring-projects/spring-security/commit/d1909ec9c8844cfa6b63bab5c2591f14d714ef6b
http://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-570204

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper Verification of Cryptographic Signature

EUVDB-ID: #VU28464

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-5407

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature