CVE-2023-34246
Doorkeeper Improper Authentication vulnerability
概要
Doorkeeper Improper Authentication vulnerability
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2023-34246 ruby-doorkeeper 修正版: 5.3.0-2+deb11u1
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- report github.com
- web github.com
- web lists.debian.org
- web lists.debian.org
- web rfc-editor.org