On behalf of the community I am pleased to announce the release of Spring Security 5.1.6 (changelog) and 5.0.13 (changelog). These releases deliver bug fixes along with some minor improvements. Users are encouraged to update to the latest patch release.

Project Site | Reference | Help

We have released Spring Security 4.2.13 to address CVE-2019-11272: PlaintextPasswordEncoder authenticates encoded passwords that are null.

Users are encouraged to update immediately.

With Spring Boot, you can override the Spring Security version in Maven like so:

<properties>
    <spring-security.version>4.2.13.RELEASE</spring-security.version>
</properties>

Or in Gradle like so:

ext['spring-security.version'] = '4.2.13.RELEASE'

Note that users of Spring Security 5+ are not affected by this vulnerability.

We have released Spring Security OAuth 2.3.6, 2.2.5, 2.1.5 and 2.0.18 to address CVE-2019-11269: Open Redirector in spring-security-oauth2. Please review the information in the CVE report and upgrade immediately.

For additional changes included in each release, please refer to:

• 2.3.6 changelog

• 2.2.5 changelog

• 2.1.5 changelog

• 2.0.18 changelog

NOTE: For users of Spring Boot 1.5.x and Spring IO Platform Cairo, it is highly recommended to override the spring-security-oauth version to the latest version containing the fix for the CVE. Please see the Mitigation section in the CVE report…

On behalf of the community, I’m pleased to announce the release of Spring Security 5.2.0.M2! This release includes 100+ updates. You can find the highlights below:

OAuth 2.0

gh-6446 - Client Support for PKCE

PKCE isn’t just for native or browser-based apps, but for any time we want to have a public client. Spring Security 5.2 introduces a secure way for backends to authenticate as public clients.

gh-5350 - OpenID Connect RP-Initiated Logout

gh-5465 - Ability to use symmetric keys with JwtDecoder

gh-5397 - Ability for NimbusReactiveJwtDecoder to take a custom processor

gh-6513 & gh-5200…

We have released Spring Security 4.2.12, 5.0.12, and 5.1.5 to address CVE-2019-3795: Insecure Randomness with SecureRandomFactoryBean. Users are encouraged to update immediately.

On behalf of the community I am pleased to announce the release of Spring Security 5.1.4 (changelog). This release provides a round of bug fixes and users are encouraged to update to the latest patch release.

Project Site | Reference | Help

On behalf of the community I am pleased to announce the release of Spring Security 5.1.3 (changelog), 5.0.11 (changelog), and 4.2.11 (changelog). This series of releases provides a round of bug fixes and users are encouraged to update to the latest patch release.

Project Site | Reference | Help

I’m pleased to announce on behalf of the community Spring Security OAuth2 Boot Auto-config 2.0.6 and 2.1.0.

Both releases primarily deliver bug fixes and dependency version updates along with some minor improvements. Of particular note is that these align with recent releases of Spring Boot.

Note that for 2.1.0, gaps in configuration of keys between Resource Server and Authorization Server were brought into parity. Now, it’s possible on the Authorization Server side to configure a single key:

security:
  oauth2:
    authorization:
      jwt:
        key-value: ${PRIVATE_KEY}

similar to…

On behalf of the community, I am pleased to announce that the Spring Security 5.0.8 (changelog) and 4.2.8 (changelog) have been released. The releases primarily deliver bug fixes and dependency version updates along with some minor improvements. The releases will be found in the upcoming Spring Boot maintenance releases coming this week.

Project Site | 4.x Reference | 5.x Reference | Help

On behalf of the community I am pleased to announce the release of Spring Security 5.1.0.RC2. This release comes with 50+ tickets closed.

As always we look forward to hearing your feedback! You can find the highlights below:

Table of Contents

• Simplified DSL for OAuth2

• WebClient Extensions

• Servlet Enhancements

  • OAuth2

    • Token Request Configuration

    • More Provider Configuration Metadata Available

    • Resource Server Claims Mapping

    • RestOperations Support

  • Other Improvements

    • X.509 Principal Extractor

    • LDAP Custom Environment Variables

• WebFlux Enhancements

  • OAuth2 Resource Server

  • OAuth2 Client

  • Redirect to Https

• Dependency Updates

…