Bug 1977064 (CVE-2021-22119)

Summary:	CVE-2021-22119 spring-security: Denial-of-Service (DoS) attack via initiation of Authorization Request
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aboyko, ahenning, aileenc, akoufoud, alazarot, anstephe, chazlett, drieden, etirelli, gmalinko, gvarsami, ibek, janstey, jcoleman, jjoyce, jochrist, jrokos, jschluet, jstastny, jwon, krathod, kverlaen, ldimaggi, lhh, lpeer, mburns, mkolesni, mnovotny, nwallace, pjindal, pskopek, rrajasek, rwagner, sclewis, scohen, sguilhen, slinaber, tcunning, tkirby, tzimanyi
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	spring-security-5.5.1, spring-security-5.4.7, spring-security-5.3.10, spring-security-5.2.11	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-07-07 18:08:36 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1977065

Description Pedro Sampaio 2021-06-28 21:02:30 UTC

Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session or multiple sessions. This vulnerability exposes OAuth 2.0 Client applications that use HttpSessionOAuth2AuthorizationRequestRepository (Servlet) and WebSessionOAuth2ServerAuthorizationRequestRepository (Reactive).

References:

https://tanzu.vmware.com/security/cve-2021-22119

Comment 3 Jonathan Christison 2021-07-02 17:56:10 UTC

This vulnerability is out of security support scope for the following products:

 * Red Hat JBoss Fuse 6
 * Red Hat Fuse Service Works 6
 

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.

Comment 5 Jonathan Christison 2021-07-05 16:06:08 UTC

Upstream fixing commits: https://github.com/spring-projects/spring-security/commit/700bda68b7b4507899221fe6774926ce0e8d9f21 and https://github.com/spring-projects/spring-security/commit/35f5ebdbcf93aa380cd57ca5ef7d579ed53f2a71

Comment 12 errata-xmlrpc 2022-07-07 14:20:33 UTC

This issue has been addressed in the following products:

  Red Hat Fuse 7.11

Via RHSA-2022:5532 https://access.redhat.com/errata/RHSA-2022:5532

Comment 13 Product Security DevOps Team 2022-07-07 18:08:32 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-22119