Medium [CVE-2026-47842] org.springframework.security/spring-security-core: Spring Security: Information disclosure via deterministic AES/CBC encryption
This medium-severity Red Hat Linux advisory covers CVE-2026-47842 affecting OpenShift Developer Tools and Services, Red Hat Fuse 7, Red Hat OpenShift Dev Spaces.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A flaw was found in Spring Security. Applications configured to use AesBytesEncryptor with a two-argument constructor or a null Initialization Vector (IV) generator in Cipher Block Chaining (CBC) mode will encrypt data using a predictable, all-zero IV.
This deterministic encryption allows an attacker to analyze encrypted data and potentially deduce patterns, leading to the disclosure of sensitive information. Because the IV is deterministic, identical plaintexts always produce identical ciphertext for a given password and salt.
An attacker with read access to the encrypted data store can exploit this to determine when two records share the same plaintext value, correlate encrypted values across rows or users, and mount dictionary attacks by pre-encrypting candidate values and comparing results. This is a continuation of CVE-2020-5408.
Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-1204.
Affected Red Hat products: OpenShift Developer Tools and Services; Red Hat Fuse 7; Red Hat OpenShift Dev Spaces; Red Hat Single Sign-On 7. Will not fix / out of support: OpenShift Developer Tools and Services; Red Hat Fuse 7; Red Hat Single Sign-On 7.
Red Hat does not currently list a fixing RHSA for this CVE.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation checklist
- Upgrade to a fixed version of Spring Security (7.1.1, 7.0.7, 6.5.12, 6.4.19, 5.8.28, or 5.7.26). Alternatively, migrate from the deprecated AesBytesEncryptor to the new AesCbcBytesEncryptor or AesGcmBytesEncryptor classes which use secure random IV generation. If using Encryptors.standard(), Encryptors.stronger(), Encryptors.text(), or Encryptors.delux(), these are also deprecated and should be replaced. Review the Spring Security migration guide to determine whether data re-encryption is required.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.