CVE-2025-22232

Vendor solution

If you cannot upgrade, then you can either:

* Remove Spring Vault from the classpath if it is not needed or * Implement your own SessionManager that does not persist the Vault token and provide a bean using that implementation in a @Configuration class. For example:

public class StatelessSessionManager implements SessionManager {

  private final ClientAuthentication clientAuthentication;

  private final ReentrantLock lock = new ReentrantLock();

  public StatelessSessionManager(ClientAuthentication clientAuthentication) {     Assert.notNull(clientAuthentication, "ClientAuthentication must not be null");     this.clientAuthentication = clientAuthentication;   }

  public VaultToken getSessionToken() {     this.lock.lock();     try {       return this.clientAuthentication.login();     }     finally {       this.lock.unlock();     }   }

}

@Configuration public class MySessionManagerConfiguration extends SpringVaultClientConfiguration {

  private final VaultEnvironmentProperties vaultProperties;

  public MySessionManagerConfiguration(VaultEnvironmentProperties vaultProperties, ConfigTokenProvider configTokenProvider, List<springvaultclientauthenticationprovider> authProviders) {     super(vaultProperties, configTokenProvider, authProviders);     this.vaultProperties = vaultProperties;   }

  @Bean   @Primary   public SessionManager sessionManager() {     if (vaultProperties.getAuthentication() == null && !StringUtils.hasText(vaultProperties.getToken())) {       return new StatelessSessionManager(clientAuthentication());     }     return super.sessionManager();   } } </springvaultclientauthenticationprovider>

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.