CVE-2024-38827 (Medium) detected in multiple libraries

[mend-bolt-for-github]

CVE-2024-38827 - Medium Severity Vulnerability

Vulnerable Libraries - spring-security-crypto-6.3.1.jar, spring-security-crypto-6.2.4.jar, spring-security-core-6.3.1.jar, spring-security-web-6.2.4.jar, spring-security-web-6.3.1.jar, spring-security-config-6.2.4.jar, spring-security-config-6.3.1.jar, spring-security-core-6.2.4.jar

spring-security-crypto-6.3.1.jar

Spring Security

Library home page: https://spring.io

Path to dependency file: /release-toggles/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-crypto/6.3.1/3e66321782db499cca3884830188a091058121f3/spring-security-crypto-6.3.1.jar

Dependency Hierarchy:

• spring-security-web-6.3.1.jar (Root Library)
  • spring-security-core-6.3.1.jar
    • ❌ spring-security-crypto-6.3.1.jar (Vulnerable Library)

spring-security-crypto-6.2.4.jar

Spring Security

Library home page: https://spring.io

Path to dependency file: /file-storage/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-crypto/6.2.4/9583253c66bafe7cbf0f082d069b08675331ce78/spring-security-crypto-6.2.4.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-crypto/6.2.4/9583253c66bafe7cbf0f082d069b08675331ce78/spring-security-crypto-6.2.4.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-crypto/6.2.4/9583253c66bafe7cbf0f082d069b08675331ce78/spring-security-crypto-6.2.4.jar

Dependency Hierarchy:

• spring-boot-starter-oauth2-resource-server-3.2.5.jar (Root Library)
  • spring-security-core-6.2.4.jar
    • ❌ spring-security-crypto-6.2.4.jar (Vulnerable Library)

spring-security-core-6.3.1.jar

Spring Security

Library home page: https://spring.io

Path to dependency file: /release-toggles/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-core/6.3.1/598c2461a17c29705ca7fd8c02efd23a1f650ccd/spring-security-core-6.3.1.jar

Dependency Hierarchy:

• spring-security-config-6.3.1.jar (Root Library)
  • ❌ spring-security-core-6.3.1.jar (Vulnerable Library)

spring-security-web-6.2.4.jar

Spring Security

Library home page: https://spring.io

Path to dependency file: /persistence/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/6.2.4/b4a436865cf6483e088c986432f44d9e90bab6a3/spring-security-web-6.2.4.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/6.2.4/b4a436865cf6483e088c986432f44d9e90bab6a3/spring-security-web-6.2.4.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/6.2.4/b4a436865cf6483e088c986432f44d9e90bab6a3/spring-security-web-6.2.4.jar

Dependency Hierarchy:

• spring-boot-starter-security-3.2.5.jar (Root Library)
  • ❌ spring-security-web-6.2.4.jar (Vulnerable Library)

spring-security-web-6.3.1.jar

Spring Security

Library home page: https://spring.io

Path to dependency file: /release-toggles/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-web/6.3.1/aff43933f28c808252b2d31f768b92fa61b634f6/spring-security-web-6.3.1.jar

Dependency Hierarchy:

• ❌ spring-security-web-6.3.1.jar (Vulnerable Library)

spring-security-config-6.2.4.jar

Spring Security

Library home page: https://spring.io

Path to dependency file: /persistence/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-config/6.2.4/ef1f16ce7900f602826b985f15b67bbe60015a08/spring-security-config-6.2.4.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-config/6.2.4/ef1f16ce7900f602826b985f15b67bbe60015a08/spring-security-config-6.2.4.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-config/6.2.4/ef1f16ce7900f602826b985f15b67bbe60015a08/spring-security-config-6.2.4.jar

Dependency Hierarchy:

• spring-boot-starter-security-3.2.5.jar (Root Library)
  • ❌ spring-security-config-6.2.4.jar (Vulnerable Library)

spring-security-config-6.3.1.jar

Spring Security

Library home page: https://spring.io

Path to dependency file: /release-toggles/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-config/6.3.1/e4f6c1cf4f8969c9e5ed26121f0fbd7ee35a7ca4/spring-security-config-6.3.1.jar

Dependency Hierarchy:

• ❌ spring-security-config-6.3.1.jar (Vulnerable Library)

spring-security-core-6.2.4.jar

Spring Security

Library home page: https://spring.io

Path to dependency file: /security/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-core/6.2.4/b1bb9c66df67cd6ecc5548dec8b37341cef11a80/spring-security-core-6.2.4.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-core/6.2.4/b1bb9c66df67cd6ecc5548dec8b37341cef11a80/spring-security-core-6.2.4.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework.security/spring-security-core/6.2.4/b1bb9c66df67cd6ecc5548dec8b37341cef11a80/spring-security-core-6.2.4.jar

Dependency Hierarchy:

• spring-boot-starter-security-3.2.5.jar (Root Library)
  • spring-security-web-6.2.4.jar
    • ❌ spring-security-core-6.2.4.jar (Vulnerable Library)

Found in HEAD commit: 335a4047c89f52dfe860e93daefb32dc86a521a2

Found in base branch: develop

Vulnerability Details

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.

Publish Date: 2024-12-02

URL: CVE-2024-38827

CVSS 3 Score Details (4.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2024-38827

Release Date: 2024-12-02

Fix Resolution (org.springframework.security:spring-security-crypto): 6.3.5

Direct dependency fix Resolution (org.springframework.security:spring-security-web): 6.3.5

Fix Resolution (org.springframework.security:spring-security-crypto): 6.3.5

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-oauth2-resource-server): 3.2.6

Fix Resolution (org.springframework.security:spring-security-core): 6.3.5

Direct dependency fix Resolution (org.springframework.security:spring-security-config): 6.3.5

Fix Resolution (org.springframework.security:spring-security-web): 6.3.5

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-security): 3.2.6

Fix Resolution (org.springframework.security:spring-security-config): 6.3.5

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-security): 3.2.6

Fix Resolution (org.springframework.security:spring-security-core): 6.3.5

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-security): 3.2.6

---

Step up your Open Source Security Game with Mend here