Vulnerability · Published May 19, 2022 · Assigned by vmware
CVE-2022-22976
Medium 5.3
In plain English
A medium-severity integer overflow in Spring Security. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.security:spring-security-core | 5.5.7 | GHSA-wx54-3278-m5g4 |
| Maven | org.springframework.security:spring-security-core | 5.6.4 | GHSA-wx54-3278-m5g4 |
| Ubuntu:25.10 | libspring-java | no fix listed | UBUNTU-CVE-2022-22976 |
| Ubuntu:26.04:LTS | libspring-java | no fix listed | UBUNTU-CVE-2022-22976 |
| Ubuntu:26.10 | libspring-java | no fix listed | UBUNTU-CVE-2022-22976 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Spring Security | Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions |
Weakness: CWE-190
References
- https://tanzu.vmware.com/security/cve-2022-22976 x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20220707-0003/ x_refsource_CONFIRM