What is GHSA-4644-hg35-55m9?

GHSA-4644-hg35-55m9 is a security advisory published by GitHub Security Advisories with Medium severity. Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security

Which CVE IDs does GHSA-4644-hg35-55m9 cover?

GHSA-4644-hg35-55m9 covers the following CVE IDs: CVE-2011-2731. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-4644-hg35-55m9?

GHSA-4644-hg35-55m9 affects 2 products, including: maven/org.springframework.security:spring-security-core:\u003c 2.0.7; maven/org.springframework.security:spring-security-core:\u003e= 3.0.0, \u003c 3.0.6.

GHSA-4644-hg35-55m9Medium

Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2011-2731 →

📋 Description

Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.

🎯 Affected products2

maven/org.springframework.security:spring-security-core:< 2.0.7
maven/org.springframework.security:spring-security-core:>= 3.0.0, < 3.0.6

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2011-2731
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814
http://support.springsource.com/security/cve-2011-2731
https://github.com/advisories/GHSA-4644-hg35-55m9