Описание
BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| libspring-security-2.0-java | removed | package |
EPSS
Процентиль: 46%
0.00588
Низкий
Связанные уязвимости
CVSS3: 7.4
redhat
больше 1 года назад
BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.
CVSS3: 7.4
nvd
больше 1 года назад
BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.
CVSS3: 7.4
github
больше 1 года назад
Spring Security Does Not Enforce Password Length
EPSS
Процентиль: 46%
0.00588
Низкий