OAuth library for nim allows insecure generation of state values by generateState - entropy too low and uses regular PRNG instead of CSPRNG
概要
OAuth library for nim allows insecure generation of state values by generateState - entropy too low and uses regular PRNG instead of CSPRNG
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
In the OAuth library for nim prior to version 0.11, the state values generated by the generateState function do not have sufficient entropy. These can be successfully guessed by an attacker allowing them to perform a CSRF vs a user, associating the user's session with the attacker's protected resources. While state isn't exactly a cryptographic value, it should be generated in a cryptographically secure way. generateState should be using a CSPRNG. Version 0.11 modifies the generateState function to generate state values of at least 128 bits of entropy while using a CSPRNG.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com