Dependency org.springframework.security:spring-security-core, leading to CVE problem

[CVEDetect]

Hi, In /IOT-Guide-JWT-Without-JPA，there is a dependency org.springframework.security:spring-security-core:5.0.8.RELEASE that calls the risk method.

CVE-2020-5408

The scope of this CVE affected version is [5.3.0.RELEASE, 5.3.2.RELEASE) [5.2.0.RELEASE, 5.2.4.RELEASE) [5.1.0.RELEASE, 5.1.10.RELEASE) [5.0.0.RELEASE, 5.0.16.RELEASE) [4.2.0.RELEASE, 4.2.16.RELEASE)

After further analysis, in this project, the main Api called is org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder: matches(java.lang.CharSequence,java.lang.String)Z

Risk method repair link : GitHub

CVE Bug Invocation Path--

Path Length : 6

iot.technology.jwt.without.controller.JwtAuthenticationController: createAuthenticationToken(iot.technology.jwt.without.model.JwtRequest)Lorg.springframework.http.ResponseEntity; /.m2/repository/javax/validation/validation-api/2.0.1.Final/validation-api-2.0.1.Final.jar
iot.technology.jwt.without.controller.JwtAuthenticationController: authenticate(java.lang.String,java.lang.String)V /.m2/repository/javax/validation/validation-api/2.0.1.Final/validation-api-2.0.1.Final.jar
org.springframework.security.authentication.ProviderManager: authenticate(org.springframework.security.core.Authentication)Lorg.springframework.security.core.Authentication; /.m2/repository/com/fasterxml/jackson/core/jackson-core/2.8.9/jackson-core-2.8.9.jar
org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider: authenticate(org.springframework.security.core.Authentication)Lorg.springframework.security.core.Authentication; /.m2/repository/com/fasterxml/jackson/core/jackson-core/2.8.9/jackson-core-2.8.9.jar
org.springframework.security.authentication.dao.DaoAuthenticationProvider: additionalAuthenticationChecks(org.springframework.security.core.userdetails.UserDetails,org.springframework.security.authentication.UsernamePasswordAuthenticationToken)V /.m2/repository/com/fasterxml/jackson/core/jackson-core/2.8.9/jackson-core-2.8.9.jar
org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder: matches(java.lang.CharSequence,java.lang.String)Z

Dependency tree--

[INFO] iot.technology:IOT-Guide-JWT-Without-JPA:jar:1.0-SNAPSHOT
[INFO] +- org.springframework.boot:spring-boot-starter-web:jar:2.0.5.RELEASE:compile
[INFO] |  +- org.springframework.boot:spring-boot-starter:jar:2.0.5.RELEASE:compile
[INFO] |  |  +- org.springframework.boot:spring-boot:jar:2.0.5.RELEASE:compile
[INFO] |  |  +- org.springframework.boot:spring-boot-autoconfigure:jar:2.0.5.RELEASE:compile
[INFO] |  |  +- org.springframework.boot:spring-boot-starter-logging:jar:2.0.5.RELEASE:compile
[INFO] |  |  |  +- ch.qos.logback:logback-classic:jar:1.2.3:compile
[INFO] |  |  |  |  +- ch.qos.logback:logback-core:jar:1.2.3:compile
[INFO] |  |  |  |  \- org.slf4j:slf4j-api:jar:1.7.7:compile
[INFO] |  |  |  +- org.apache.logging.log4j:log4j-to-slf4j:jar:2.10.0:compile
[INFO] |  |  |  |  \- org.apache.logging.log4j:log4j-api:jar:2.10.0:compile
[INFO] |  |  |  \- org.slf4j:jul-to-slf4j:jar:1.7.7:compile
[INFO] |  |  +- javax.annotation:javax.annotation-api:jar:1.3.2:compile
[INFO] |  |  +- org.springframework:spring-core:jar:5.0.9.RELEASE:compile
[INFO] |  |  |  \- org.springframework:spring-jcl:jar:5.0.9.RELEASE:compile
[INFO] |  |  \- org.yaml:snakeyaml:jar:1.19:runtime
[INFO] |  +- org.springframework.boot:spring-boot-starter-json:jar:2.0.5.RELEASE:compile
[INFO] |  |  +- com.fasterxml.jackson.datatype:jackson-datatype-jdk8:jar:2.9.6:compile
[INFO] |  |  +- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.9.6:compile
[INFO] |  |  \- com.fasterxml.jackson.module:jackson-module-parameter-names:jar:2.9.6:compile
[INFO] |  +- org.springframework.boot:spring-boot-starter-tomcat:jar:2.0.5.RELEASE:compile
[INFO] |  |  +- org.apache.tomcat.embed:tomcat-embed-core:jar:8.5.34:compile
[INFO] |  |  +- org.apache.tomcat.embed:tomcat-embed-el:jar:8.5.34:compile
[INFO] |  |  \- org.apache.tomcat.embed:tomcat-embed-websocket:jar:8.5.34:compile
[INFO] |  +- org.hibernate.validator:hibernate-validator:jar:6.0.12.Final:compile
[INFO] |  |  +- javax.validation:validation-api:jar:2.0.1.Final:compile
[INFO] |  |  +- org.jboss.logging:jboss-logging:jar:3.3.2.Final:compile
[INFO] |  |  \- com.fasterxml:classmate:jar:1.3.4:compile
[INFO] |  +- org.springframework:spring-web:jar:5.0.9.RELEASE:compile
[INFO] |  |  \- org.springframework:spring-beans:jar:5.0.9.RELEASE:compile
[INFO] |  \- org.springframework:spring-webmvc:jar:5.0.9.RELEASE:compile
[INFO] |     +- org.springframework:spring-context:jar:5.0.9.RELEASE:compile
[INFO] |     \- org.springframework:spring-expression:jar:5.0.9.RELEASE:compile
[INFO] +- org.springframework.boot:spring-boot-starter-security:jar:2.0.5.RELEASE:compile
[INFO] |  +- org.springframework:spring-aop:jar:5.0.9.RELEASE:compile
[INFO] |  +- org.springframework.security:spring-security-config:jar:5.0.8.RELEASE:compile
[INFO] |  |  \- org.springframework.security:spring-security-core:jar:5.0.8.RELEASE:compile
[INFO] |  \- org.springframework.security:spring-security-web:jar:5.0.8.RELEASE:compile
[INFO] +- io.jsonwebtoken:jjwt:jar:0.9.0:compile
[INFO] |  \- com.fasterxml.jackson.core:jackson-databind:jar:2.8.9:compile
[INFO] |     +- com.fasterxml.jackson.core:jackson-annotations:jar:2.8.0:compile
[INFO] |     \- com.fasterxml.jackson.core:jackson-core:jar:2.8.9:compile
[INFO] \- org.projectlombok:lombok:jar:1.18.4:compile

Suggested solutions:

Update dependency version

Thank you very much.