GHSA-mg83-c7gq-rv5c Spring Security Does Not Enforce Password Length

• Maven org.springframework.security:spring-security-crypto: >= 6.3.0, < 6.3.8 → fixed in 6.3.8 • Maven org.springframework.security:spring-security-crypto: >= 6.4.0, < 6.4.4 → fixed in 6.4.4 • Maven org.springframework.security:spring-security-crypto: >= 6.2.0, < 6.2.10 → fixed in 6.2.10 • Maven org.springframework.security:spring-security-crypto: >= 6.1.0, < 6.1.14 → fixed in 6.1.14 • Maven org.springframework.security:spring-security-crypto: >= 6.0.0, < 6.0.16 → fixed in 6.0.16 • Maven org.springframework.security:spring-security-crypto: >= 5.8.0, < 5.8.18 → fixed in 5.8.18 • Maven org.springframework.security:spring-security-crypto: < 5.7.16 → fixed in 5.7.16

BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.