Spring-related vulnerabilities for RSA Authentication Manager
2 months ago
Article Number
000068177
Applies To

RSA Product/Service Type: Authentication Manager

RSA Version/Condition: 8.8.x and earlier

CVE Identifier(s)
CVE-2016-1000027, CVE-2018-11039, CVE-2020-5421, CVE-2022-22965, CVE-2022-22970
Article Summary
  1. CVE-2016-1000027

Link

https://nvd.nist.gov/vuln/detail/CVE-2016-1000027

 

Component

spring-web version 3.2.18

 

RSA Response

Authentication Manager uses the readRemoteInvocation function from the Spring interface HttpInvokerServiceExporter, which can potentially allow deserialization of untrusted objects if the endpoints are exposed to untrusted clients. As per CVE-2016-1000027, any interface that permits deserialization of objects from untrusted clients may be impacted. However, Authentication Manager restricts access to the HttpInvokerServiceExporter service to only trusted and authenticated clients, hence, there is no impact on Authentication Manager due to this CVE.

 

Component 

spring-web version 5.3.22

 

RSA Response

Authentication Manager is not vulnerable because the product (OpenSAML service) doesn't use the readRemoteInvocation function of HttpInvokerServiceExporter in spring-web version 5.3.22.

 

  1. CVE-2018-11039

Link 

https://nvd.nist.gov/vuln/detail/CVE-2018-11039

 

Component

spring-web version 3.2.18

 

RSA Response

Authentication Manager is not vulnerable because the product doesn't use HiddenHttpMethodFilter of spring-web version 3.2.18.


  1. CVE-2020-5421

Link

https://nvd.nist.gov/vuln/detail/CVE-2020-5421

 

Component

spring-web version 3.2.18

 

RSA Response

Authentication Manager is not vulnerable because the product uses CSRF filters and provides Content-Disposition header in the response to mitigate this vulnerability.


  1. CVE-2022-22965

Link

https://nvd.nist.gov/vuln/detail/cve-2022-22965

 

Component 

spring-beans version 3.2.18

 

RSA Response 

The exploitation of this vulnerability is only possible with JRE 9 and above, and Apache Tomcat 9. Authentication Manager 8.7 SP1 is not vulnerable because the product doesn't use such combination of JRE and Tomcat with spring-beans version 3.2.18.


  1. CVE-2022-22970

Link

https://nvd.nist.gov/vuln/detail/CVE-2022-22970

 

Component

spring-beans version 3.2.18

 

RSA Response

Authentication Manager is not vulnerable because the product doesn't use MultipartFile of spring-beans version 3.2.18.

 

 

Disclaimer
Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact RSA Technical Support at 1-800-995-5095. RSA Security LLC and its affiliates distribute RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information. RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided 'as is' without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall RSA, its affiliates, or suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates, or suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.

Related Articles

Trending Articles

Don't see what you're looking for?