CVE-2022-22976
Fixed in a distro release EPSS 2%
Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE.
Products: vmware spring_security, oracle financial_services_crime_and_compliance_management_studio, netapp active_iq_unified_manager
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.springframework.security:spring-security-core | 5.5.7 |
| Maven | org.springframework.security:spring-security-core | 5.6.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat ocp tools 4.11 | jenkins | 0:2.401.1.1686831596-3.el8 |
| Red Hat ocp tools 4.11 | jenkins-2-plugins | 0:4.11.1686831822-1.el8 |
| Ubuntu 25.10 | libspring-java | no fix |
| Ubuntu 26.04 LTS | libspring-java | no fix |
| Ubuntu 26.10 | libspring-java | no fix |
| Ubuntu Pro 14.04 LTS | libspring-java | no fix |
| Ubuntu Pro 16.04 LTS | libspring-java | no fix |
| Ubuntu Pro 18.04 LTS | libspring-java | no fix |
| Ubuntu Pro 20.04 LTS | libspring-java | no fix |
| Ubuntu Pro 22.04 LTS | libspring-java | no fix |
| Ubuntu Pro 24.04 LTS | libspring-java | no fix |