CVE-2021-22119 Resource Exhaustion in Spring Security
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2021-22119?
CVE-2021-22119 is a high-severity vulnerability in Oracle Communications Cloud Native Core Policy, published on 29 Jun 2021.
Official description
Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session or multiple sessions.
Which versions are affected by CVE-2021-22119?
16 open source packages ship an affected version, including org.springframework.security:spring-security-core and org.springframework.security:spring-security-oauth2-client. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.security:spring-security-core Maven | From 5.2.0 | 5.2.11 |
org.springframework.security:spring-security-core Maven | From 5.2.0 | 5.2.11 |
org.springframework.security:spring-security-core Maven | From 5.3.0 | 5.3.10 |
org.springframework.security:spring-security-core Maven | From 5.3.0 | 5.3.10 |
org.springframework.security:spring-security-core Maven | From 5.4.0 | 5.4.7 |
org.springframework.security:spring-security-core Maven | From 5.4.0 | 5.4.7 |
10 more packages
org.springframework.security:spring-security-core Maven | From 5.5.0 | 5.5.1 |
org.springframework.security:spring-security-core Maven | From 5.5.0 | 5.5.1 |
org.springframework.security:spring-security-oauth2-client Maven | From 5.2.0 | 5.2.11 |
org.springframework.security:spring-security-oauth2-client Maven | From 5.2.0 | 5.2.11 |
org.springframework.security:spring-security-oauth2-client Maven | From 5.3.0 | 5.3.10 |
org.springframework.security:spring-security-oauth2-client Maven | From 5.3.0 | 5.3.10 |
org.springframework.security:spring-security-oauth2-client Maven | From 5.4.0 | 5.4.7 |
org.springframework.security:spring-security-oauth2-client Maven | From 5.4.0 | 5.4.7 |
org.springframework.security:spring-security-oauth2-client Maven | From 5.5.0 | 5.5.1 |
org.springframework.security:spring-security-oauth2-client Maven | From 5.5.0 | 5.5.1 |
Products include Oracle Communications Cloud Native Core Policy, Vmware Spring Security.
How do I fix CVE-2021-22119?
Upgrade org.springframework.security:spring-security-core to a fixed version for your release line: 5.2.11, 5.3.10, 5.4.7 or 5.5.1.
Is CVE-2021-22119 being exploited?
There is no known exploitation of CVE-2021-22119 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Oracle Communications Cloud Native Core Policy
- CVE-2021-35574 Denial of service in Outside In Technology
- CVE-2021-23440 Prototype Pollution
- CVE-2019-3799 Directory Traversal with spring-cloud-config-server
- CVE-2021-33880 Observable Timing Discrepancy in aaugustin websockets library
All Oracle Communications Cloud Native Core Policy vulnerabilities
Sources
Also known as GHSA-w9jg-gvgr-354m.