https://bugzilla.redhat.com/show_bug.cgi?id=1553565
Bug ID: 1553565
Summary: spring-security:
LdapUserDetailsManager.java:changePassword() allows
for direct modificiation of user passwords, bypassing
the security configuration
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: aileenc(a)redhat.com, apevec(a)redhat.com,
chazlett(a)redhat.com, chrisw(a)redhat.com,
gvarsami(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jjoyce(a)redhat.com,
jschluet(a)redhat.com, kbasil(a)redhat.com,
kconner(a)redhat.com, ldimaggi(a)redhat.com,
lhh(a)redhat.com, lpeer(a)redhat.com, markmc(a)redhat.com,
mburns(a)redhat.com, mkolesni(a)redhat.com,
nwallace(a)redhat.com, nyechiel(a)redhat.com,
pavelp(a)redhat.com, puntogil(a)libero.it,
rbryant(a)redhat.com, rwagner(a)redhat.com,
sclewis(a)redhat.com, slinaber(a)redhat.com,
tcunning(a)redhat.com, tdecacqu(a)redhat.com,
tkirby(a)redhat.com
Spring Security through version 5.0.3, allows for direct modification of user
passwords in the LdapUserDetailsManager.java:changePassword() function, which
conflicts with RFC 3062 and allows for security configuration bypass.
Upstream Issue:
https://github.com/spring-projects/spring-security/issues/3392
--
You are receiving this mail because:
You are on the CC list for the bug.