Doorkeeper Improper Authentication vulnerability
Résumé
Doorkeeper Improper Authentication vulnerability
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2023-34246 ruby-doorkeeper Corrigé dans: 5.3.0-2+deb11u1
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- report github.com
- web github.com
- web lists.debian.org
- web lists.debian.org
- web rfc-editor.org