GitHub Advisoryadvisory · Go
GHSA-f28g-86hc-823q Tokenizer vulnerable to client brute-force of token secrets
MEDIUM
Official page ↗
- Ecosystem
- Go
- Packages
- github.com/superfly/tokenizer
- Severity
- Moderate
- Reviewed
- 2023-07-13
Affected packages
• Go github.com/superfly/tokenizer: < 0.0.1 → fixed in 0.0.1
Description
Impact
Authorized clients, having an `inject_processor` secret, could brute-force the secret token value by abusing the `fmt` parameter to the `Proxy-Tokenizer` header.
Patches
This was fixed in https://github.com/superfly/tokenizer/pull/8 and further mitigated in https://github.com/superfly/tokenizer/pull/9.