Lack of data validation - Type confusion In org.springframework.ldap:spring-ldap-core
Description
Spring LDAP data exposure vulnerability A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0.
The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 debian 11 | - | ||
debian 13 | - | ||
debian 12 | - | ||
debian 14 | - | ||
 maven | 3.2.8, 2.4.4 |
Aliases
References