CVE-2024-38829 Spring LDAP sensitive data exposure for case-sensitive comparisons
Locale-dependent string handling in Spring LDAP may expose sensitive data by querying unintended columns during case-sensitive comparisons.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-38829?
CVE-2024-38829 is a low-severity vulnerability in Spring LDAP, published on 4 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0.
The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820
Weakness: CWE-178
Which versions are affected by CVE-2024-38829?
4 open source packages ship an affected version, including org.springframework.ldap:spring-ldap-core.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.ldap:spring-ldap-core Maven | All versions | 2.4.4 |
org.springframework.ldap:spring-ldap-core Maven | All versions | 2.4.4 |
org.springframework.ldap:spring-ldap-core Maven | From 3.0.0 | 3.2.8 |
org.springframework.ldap:spring-ldap-core Maven | From 3.0.0 | 3.2.8 |
How do I fix CVE-2024-38829?
Upgrade org.springframework.ldap:spring-ldap-core to a fixed version for your release line: 2.4.4 or 3.2.8.
Is CVE-2024-38829 being exploited?
There is no known exploitation of CVE-2024-38829 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-38829, ECHO-b115-b5ea-e973, GHSA-mqvr-2rp8-j7h4, ROOT-APP-MAVEN-CVE-2024-38829, UBUNTU-CVE-2024-38829.