GHSA-j7vx-8mqj-cqp9 Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper

• RubyGems doorkeeper: >= 5.0.0, < 5.0.3 → fixed in 5.0.3 • RubyGems doorkeeper: >= 5.1.0, < 5.1.1 → fixed in 5.1.1 • RubyGems doorkeeper: >= 5.2.0, < 5.2.5 → fixed in 5.2.5 • RubyGems doorkeeper: >= 5.3.0, < 5.3.2 → fixed in 5.3.2

Impact Information disclosure vulnerability. Allows an attacker to see all `Doorkeeper::Application` model attribute values (including secrets) using authorized applications controller if it's enabled (GET /oauth/authorized_applications.json). Patches These versions have the fix: • 5.0.3 • 5.1.1 • 5.2.5 • 5.3.2 Workarounds Patch `Doorkeeper::Application` model `#as_json(options = {})` method and define only those attributes you want to expose. Additional recommended hardening is to enable application secrets hashing (guide), available since Doorkeeper 5.1. This would render the exposed secret useless. References • Commit with fix: https://github.com/doorkeeper-gem/doorkeeper/commit/25d038022c2fcad45af5b73f9d003cf38ff491f6 • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10187