Description
Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked.This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Spring Spring Security
Default version status: unaffected
5.7.0 to ≤ 5.7.22affected5.8.0 to ≤ 5.8.24affected6.3.0 to ≤ 6.3.15affected6.4.0 to ≤ 6.4.15unknown6.5.0 to ≤ 6.5.9affected7.0.0 to ≤ 7.0.4affected