Stay Secure with the Latest Linux Advisories

security advisorysecurity updatecritical

Debian LTS: DLA-1848-1 Critical: libspring-security Plain Text Passwords

Spring Security support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user . Package : libspring-security-2.0-java Version : 2.0.7.RELEASE-3+deb8u2 CVE ID : CVE-2019-11272 Spring Security support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null". For Debian 8 "Jessie", this problem has been fixed in version 2.0.7.RELEASE-3+deb8u2. We recommend that you upgrade your libspring-security-2.0-java packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Enhance libspring-security-2.0-java to address vulnerabilities associated with unencrypted passwords during user authentication.. libspring-security, plain text passwords, security update. . Severity: Critical. LinuxSecurity.com Team

Jul 09, 2019 •Critical Debian LTS