Описание
Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network.
Spring Security 7.1.0
Spring Security InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network.
In Spring Security 7.1.0, the internal address classification did not recognize the IPv4 and IPv6 any local addresses (0.0.0.0 and ::) as internal. As a result, matchExternal() incorrectly classified these addresses as external, and matchInternal() failed to classify them as internal.
Отчет
A flaw was found in Spring Security 7.1.0 where the InetAddressMatchers utility does not correctly classify IPv4 and IPv6 "any local" addresses (0.0.0.0 and ::) as internal network addresses. Applications that rely on matchInternal() or matchExternal() for IP-based access control may incorrectly treat these addresses as external, potentially allowing unauthorized read access to resources intended for internal networks only. Red Hat OpenShift Jenkins (ocp-tools) in Red Hat OpenShift Container Platform 4.20 includes Spring Security 7.1.0 and is affected. Other Red Hat Hybrid Platforms products evaluated for this flaw, including Red Hat OpenShift Dev Spaces, do not include the affected Spring Security version and are not affected.
Меры по смягчению последствий
Mitigation for this issue is either not available or does not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation use cases, and the lack of negative side effects to extended use. For the above product(s), Red Hat recommends that customers evaluate each potential workaround as part of their own risk assessment. Upstream fix: upgrade Spring Security to 7.1.1 or later. Workaround: replace InetAddressMatchers.matchInternal() or matchExternal() usage with explicit CIDR-based IpAddressMatcher rules for the private ranges your deployment requires (for example 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Developer Tools and Services | jenkins | Out of support scope | ||
| OpenShift Developer Tools and Services | ocp-tools-4/jenkins-rhel8 | Out of support scope | ||
| OpenShift Developer Tools and Services | ocp-tools-4/jenkins-rhel9 | Out of support scope | ||
| Red Hat Fuse 7 | spring-security-core | Out of support scope | ||
| Red Hat OpenShift Dev Spaces | devspaces/openvsx-rhel9 | Fix deferred | ||
| Red Hat OpenShift Dev Spaces | devspaces/pluginregistry-rhel9 | Fix deferred | ||
| Red Hat Single Sign-On 7 | spring-security-core | Out of support scope |
Показывать по
Дополнительная информация
Статус:
EPSS
3.7 Low
CVSS3
Связанные уязвимости
Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network. Spring Security 7.1.0
Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network. Spring Security 7.1.0
Spring Security's InetAddressMatchers utility provides matchInternal() ...
Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network. Spring Security 7.1.0
EPSS
3.7 Low
CVSS3