Bug 1553565

Summary:	spring-security: LdapUserDetailsManager.java:changePassword() allows for direct modificiation of user passwords, bypassing the security configuration
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aileenc, apevec, chazlett, chrisw, gvarsami, hghasemb, java-sig-commits, jcoleman, jjoyce, jschluet, kbasil, kconner, ldimaggi, lhh, lpeer, markmc, mburns, mkolesni, nwallace, nyechiel, pavelp, puntogil, rbryant, rwagner, sclewis, sfowler, slinaber, tcunning, tdecacqu, tkirby
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-04-22 23:01:43 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1553566
Bug Blocks:	1553567

Description Sam Fowler 2018-03-09 05:28:04 UTC

Spring Security through version 5.0.3, allows for direct modification of user passwords in the LdapUserDetailsManager.java:changePassword() function, which conflicts with RFC 3062 and allows for security configuration bypass.


Upstream Issue:

https://github.com/spring-projects/spring-security/issues/3392

Comment 1 Sam Fowler 2018-03-09 05:28:43 UTC

Created springframework-security tracking bugs for this issue:

Affects: fedora-all [bug 1553566]

Comment 4 Summer Long 2018-03-14 02:13:22 UTC

Statement:

This issue does not affect any versions of OpenDaylight as shipped with Red Hat OpenStack Platform (the flawed spring-security-ldap code is not packaged in OpenDaylight).