Spring-related vulnerabilities for RSA Authentication Manager 8.9
3 months ago
Article Number
000073761
Applies To

RSA Product/Service Type: Authentication Manager 

RSA Version/Condition: 8.9.x

CVE Identifier(s)
CVE-2016-1000027, CVE-2025-41249, CVE-2024-38819, CVE-2024-38816
Article Summary
  1. CVE-2016-1000027

Link

https://nvd.nist.gov/vuln/detail/CVE-2016-1000027

 

Component

spring-web version 5.3.39

 

RSA Response

Authentication Manager uses the readRemoteInvocation function from the Spring interface HttpInvokerServiceExporter, which can potentially allow deserialization of untrusted objects if the endpoints are exposed to untrusted clients. As per CVE-2016-1000027, any interface that permits deserialization of objects from untrusted clients may be impacted. However, Authentication Manager restricts access to the HttpInvokerServiceExporter service to only trusted and authenticated clients, hence, there is no impact on Authentication Manager due to this CVE.

 

  1. CVE-2025-41249

Link

https://nvd.nist.gov/vuln/detail/CVE-2025-41249

 

Component

spring-core version 5.3.31 and 5.3.39

 

RSA Response

Authentication Manager is not vulnerable because the product doesn't use Spring Security's @EnableMethodSecurity feature.

 

  1. CVE-2024-38819

Link

https://nvd.nist.gov/vuln/detail/CVE-2024-38819

 

Component

spring-webmvc version 5.3.30

 

RSA Response

Authentication Manager is not vulnerable because the product doesn't use WebMvc.fn and WebFlux.fn.

 

  1. CVE-2024-38816

Link

https://nvd.nist.gov/vuln/detail/CVE-2024-38816

 

Component

spring-webmvc version 5.3.30

 

RSA Response

Authentication Manager is not vulnerable because the product doesn't use WebMvc.fn and WebFlux.fn.

 

 

 

Disclaimer
Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact RSA Technical Support at 1-800-995-5095. RSA Security LLC and its affiliates distribute RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information. RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided 'as is' without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall RSA, its affiliates, or suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates, or suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.
Don't see what you're looking for?