CVE-2022-22978
Fixed in a distro release EPSS 12%
In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
Products: vmware spring_security, oracle financial_services_crime_and_compliance_management_studio, netapp active_iq_unified_manager
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.springframework.security:spring-security-core | 5.5.7 |
| Maven | org.springframework.security:spring-security-core | 5.6.4 |
| Maven | org.springframework.security:spring-security-core | 5.4.11 |
| Maven | org.springframework.security:spring-security-web | 5.5.7 |
| Maven | org.springframework.security:spring-security-web | 5.6.4 |
| Maven | org.springframework.security:spring-security-web | 5.4.11 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat ocp tools 4.13 | jenkins | 0:2.387.3.1684911776-3.el8 |
| Red Hat ocp tools 4.13 | jenkins-2-plugins | 0:4.13.1684911916-1.el8 |
| Ubuntu 25.10 | libspring-java | no fix |
| Ubuntu 26.04 LTS | libspring-java | no fix |
| Ubuntu 26.10 | libspring-java | no fix |
| Ubuntu Pro 14.04 LTS | libspring-java | no fix |
| Ubuntu Pro 16.04 LTS | libspring-java | no fix |
| Ubuntu Pro 18.04 LTS | libspring-java | no fix |
| Ubuntu Pro 20.04 LTS | libspring-java | no fix |
| Ubuntu Pro 22.04 LTS | libspring-java | no fix |
| Ubuntu Pro 24.04 LTS | libspring-java | no fix |