GitHub Advisoryadvisory · RubyGems
GHSA-3m6r-39p3-jq25 Doorkeeper is vulnerable to replay attacks
CRITICAL
Official page ↗
- Aliases
- CVE-2016-6582
- Ecosystem
- RubyGems
- Packages
- doorkeeper
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- Weaknesses
- CWE-1254
- Reviewed
- 2020-06-16
Affected packages
• RubyGems doorkeeper: < 4.2.0 → fixed in 4.2.0
Description
The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
Related
Alias · CVE (1)
- CVE-2016-6582 The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging… vulnerability
Weakness · CWE (1)
- CWE-1254 Incorrect Comparison Logic Granularity weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-6582 advisory
- https://github.com/doorkeeper-gem/doorkeeper/issues/875 web
- https://github.com/advisories/GHSA-3m6r-39p3-jq25 advisory
- https://github.com/doorkeeper-gem/doorkeeper web
- https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v4.2.0 web
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper/CVE-2016-6582.yml web
- https://web.archive.org/web/20170214021758/http://www.securityfocus.com/bid/92551 web
- https://web.archive.org/web/20201207202519/http://www.securityfocus.com/archive/1/539268/100/0/threaded web
- http://packetstormsecurity.com/files/138430/Doorkeeper-4.1.0-Token-Revocation.html web
- http://seclists.org/fulldisclosure/2016/Aug/105 web
- http://www.openwall.com/lists/oss-security/2016/08/19/2 web