Under Some Conditions Spring Security HTTP Headers Are not Written

When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written.  This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers: : from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

N/A

Spring Security 安全漏洞

Spring Security是Spring开源的一款具有认证和授权功能的安全框架。 Spring Security存在安全漏洞，该漏洞源于使用Spring Security为servlet应用程序指定HTTP响应标头时，可能不会写入HTTP标头。以下版本受到影响：5.7.21及之前版本、5.8.23及之前版本、6.3.14及之前版本、6.4.14及之前版本、6.5.8及之前版本和7.0.3及之前版本。

N/A

N/A