CVE-2024-22257
Fixed in a distro release EPSS <1%CVSS 8.2
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.
Products: pivotal_software spring_security
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.springframework.security:spring-security-core | 5.7.12 |
| Maven | org.springframework.security:spring-security-core | 5.8.11 |
| Maven | org.springframework.security:spring-security-core | 6.1.8 |
| Maven | org.springframework.security:spring-security-core | 6.2.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | kayenta-2025.4 | 2025.4.3-r6 |
| Chainguard | kayenta-2026.0 | 2026.0.2-r6 |
| Chainguard | kayenta-fips-2025.4 | 2025.4.3-r7 |
| Chainguard | kayenta-fips-2026.0 | 2026.0.2-r7 |