spring-boot-starter-oauth2-client-3.1.5.jar: 2 vulnerabilities (highest severity is: 9.1) reachable

[mend-for-github-com[bot]]

Vulnerable Library - spring-boot-starter-oauth2-client-3.1.5.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-oauth2-client/6.1.5/spring-security-oauth2-client-6.1.5.jar

Vulnerabilities

CVE	Severity	CVSS	Exploit Maturity	EPSS	Dependency	Type	Fixed in (spring-boot-starter-oauth2-client version)	Remediation Possible**	Reachability
CVE-2024-22234	Critical	9.1	Not Defined	0.0%	spring-security-oauth2-client-6.1.5.jar	Transitive	3.1.9	✅	Reachable
CVE-2023-52428	High	8.7	Not Defined	0.0%	nimbus-jose-jwt-9.24.4.jar	Transitive	3.2.7	✅	Reachable

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-22234

### Vulnerable Library - spring-security-oauth2-client-6.1.5.jar

Spring Security

Library home page: https://spring.io/projects/spring-security

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-oauth2-client/6.1.5/spring-security-oauth2-client-6.1.5.jar

Dependency Hierarchy: - spring-boot-starter-oauth2-client-3.1.5.jar (Root Library) - :x: **spring-security-oauth2-client-6.1.5.jar** (Vulnerable Library)

Found in base branch: v1.0

### Reachability Analysis This vulnerability is potentially reachable ``` org.owasp.webgoat.webwolf.WebSecurityConfig (Application) -> org.springframework.security.config.annotation.web.builders.HttpSecurity (Extension) -> org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2ClientConfigurer (Extension) -> ❌ org.springframework.security.oauth2.client.web.AuthenticatedPrincipalOAuth2AuthorizedClientRepository (Vulnerable Component) ```

### Vulnerability Details

In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method. Specifically, an application is vulnerable if: * The application uses AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly and a null authentication parameter is passed to it resulting in an erroneous true return value. An application is not vulnerable if any of the following is true: * The application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly. * The application does not pass null to AuthenticationTrustResolver.isFullyAuthenticated * The application only uses isFullyAuthenticated via Method Security https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html  or HTTP Request Security https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html

Publish Date: 2024-02-20

URL: CVE-2024-22234

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

### CVSS 4 Score Details (9.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A

For more information on CVSS4 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2024-22234

Release Date: 2024-02-20

Fix Resolution (org.springframework.security:spring-security-oauth2-client): 6.1.7

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-oauth2-client): 3.1.9

In order to enable automatic remediation, please create workflow rules

CVE-2023-52428

### Vulnerable Library - nimbus-jose-jwt-9.24.4.jar

Java library for Javascript Object Signing and Encryption (JOSE) and JSON Web Tokens (JWT)

Library home page: https://bitbucket.org/connect2id/nimbus-jose-jwt

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/nimbusds/nimbus-jose-jwt/9.24.4/nimbus-jose-jwt-9.24.4.jar

Dependency Hierarchy: - spring-boot-starter-oauth2-client-3.1.5.jar (Root Library) - spring-security-oauth2-client-6.1.5.jar - oauth2-oidc-sdk-9.43.3.jar - :x: **nimbus-jose-jwt-9.24.4.jar** (Vulnerable Library)

Found in base branch: v1.0

### Reachability Analysis This vulnerability is potentially reachable ``` org.owasp.webgoat.webwolf.WebSecurityConfig (Application) -> org.springframework.security.config.annotation.web.builders.HttpSecurity (Extension) -> org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer (Extension) -> org.springframework.security.oauth2.client.oidc.authentication.OidcIdTokenDecoderFactory (Extension) ... -> com.nimbusds.jwt.proc.DefaultJWTProcessor (Extension) -> com.nimbusds.jose.crypto.factories.DefaultJWEDecrypterFactory (Extension) -> ❌ com.nimbusds.jose.crypto.PasswordBasedDecrypter (Vulnerable Component) ```

### Vulnerability Details

In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.

Publish Date: 2024-02-11

URL: CVE-2023-52428

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

### CVSS 4 Score Details (8.7)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A

For more information on CVSS4 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-52428

Release Date: 2024-02-11

Fix Resolution (com.nimbusds:nimbus-jose-jwt): 9.37.2

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-oauth2-client): 3.2.7

In order to enable automatic remediation, please create workflow rules

---

In order to enable automatic remediation for this issue, please create workflow rules

[mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-for-github-com[bot]]

:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.