JVNDB-2022-000037

Spring Security OAuth (spring-security-oauth2) vulnerable to denial-of-service (DoS)

Spring Security OAuth (spring-security-oauth2) provided by VMware, Inc. contains a denial-of-service vulnerability due to uncontrolled resource consumption (CWE-400).
Note that Spring Security OAuth (spring-security-oauth2) is no longer supported, therefore Spring Security has been developed as the alternative, and the similar vulnerability known as CVE-2021-22119 was identified but has been addressed.

Macchinetta/TERASOLUNA Framework Development Team:NTT DATA Corporation, NTT COMWARE, and NTT reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

VMware

• Spring Security OAuth (spring-security-oauth2) 2.5.1 and earlier

A website that provides OAuth client functionality using Spring Security OAuth (spring-security-oauth2) may fall into a denial-of-service condition.

[Update the software]
Update the software to the latest version according to the information provided by the developer.

VMware

• VMware : Spring Security OAuth
• VMware Tanzu : CVE-2022-22969: Denial-of-Service (DoS) in spring-security-oauth2

NTT DATA

• NTT DATA Corporation : TERASOLUNA Server Framework for Java (5.x) (in Japanese)

1. No Mapping(CWE-Other) [IPA Evaluation]

1. CVE-2022-22969

1. JVN : JVN#15317878

• [2022/05/20]
    Web page was published