netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-rj7m-2p3g-fjxg
GHSA-4v5x-9m47-cqr2
GHSA-5565-3c98-g6jc
This commit is contained in:
advisory-database[bot]
2025-03-25 21:51:10 +00:00
parent 83b3fab8ae
commit 1316837072
3 changed files with 154 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2023/02/GHSA-rj7m-2p3g-fjxg/GHSA-rj7m-2p3g-fjxg.json
+3 -2
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rj7m-2p3g-fjxg",
"modified": "2023-02-13T20:51:27Z",
"modified": "2025-03-25T21:48:03Z",
"published": "2023-02-06T06:30:25Z",
"aliases": [
"CVE-2022-25855"
@@ -51,7 +51,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-77"
"CWE-77",
"CWE-78"
],
"severity": "HIGH",
"github_reviewed": true,
advisories/github-reviewed/2024/12/GHSA-4v5x-9m47-cqr2/GHSA-4v5x-9m47-cqr2.json
+5 -6
View File
@@ -1,13 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4v5x-9m47-cqr2",
"modified": "2024-12-10T19:06:02Z",
"modified": "2025-03-25T21:48:41Z",
"published": "2024-12-09T21:31:02Z",
"aliases": [
"CVE-2024-12369"
],
"summary": "WildFly Elytron OpenID Connect Client Extension authorization code injection attack",
"details": "A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack.",
"withdrawn": "2025-03-25T21:48:41Z",
"aliases": [],
"summary": "Duplicate Advisory: WildFly Elytron OpenID Connect Client Extension authorization code injection attack",
"details": "# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of [GHSA-5565-3c98-g6jc](https://advisory-inbox.githubapp.com/advisory_reviews/GHSA-5565-3c98-g6jc). This link is maintained to preserve external references.\n\n# Original Description\nA vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack.",
"severity": [
{
"type": "CVSS_V3",
advisories/github-reviewed/2025/03/GHSA-5565-3c98-g6jc/GHSA-5565-3c98-g6jc.json
+146
View File
@@ -0,0 +1,146 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5565-3c98-g6jc",
"modified": "2025-03-25T21:49:11Z",
"published": "2025-03-25T21:49:11Z",
"aliases": [
"CVE-2024-12369"
],
"summary": "WildFly Elytron OpenID Connect Client ExtensionOIDC authorization code injection attack",
"details": "### Impact\n\nA vulnerability was found in OIDC-Client. When using the elytron-oidc-client subsystem with WildFly, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack.\n\n### Patches\n\n[2.2.9.Final](https://github.com/wildfly-security/wildfly-elytron/releases/tag/2.2.9.Final)\n[2.6.2.Final](https://github.com/wildfly-security/wildfly-elytron/releases/tag/2.6.2.Final)\n\n### Workarounds\n\nCurrently, no mitigation is currently available for this vulnerability.\n\n### References\n\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-12369\nhttps://access.redhat.com/security/cve/CVE-2024-12369\t\nhttps://bugzilla.redhat.com/show_bug.cgi?id=2331178\nhttps://issues.redhat.com/browse/ELY-2887",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.wildfly.security:wildfly-elytron"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.17.0.Final"
},
{
"fixed": "2.2.9.Final"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.wildfly.security:wildfly-elytron"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.3.0.Final"
},
{
"fixed": "2.6.2.Final"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.wildfly.security:wildfly-elytron-http-oidc"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.17.0.Final"
},
{
"fixed": "2.2.9.Final"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.wildfly.security:wildfly-elytron-http-oidc"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.3.0.Final"
},
{
"fixed": "2.6.2.Final"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/wildfly-security/wildfly-elytron/security/advisories/GHSA-5565-3c98-g6jc"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12369"
},
{
"type": "WEB",
"url": "https://github.com/wildfly-security/wildfly-elytron/pull/2253"
},
{
"type": "WEB",
"url": "https://github.com/wildfly-security/wildfly-elytron/pull/2261"
},
{
"type": "WEB",
"url": "https://github.com/wildfly-security/wildfly-elytron/commit/5ac5e6bbcba58883b3cebb2ddbcec4de140c5ceb"
},
{
"type": "WEB",
"url": "https://github.com/wildfly-security/wildfly-elytron/commit/d7754f5a6a91ceb0f4dbbbfe301991f6a55404cb"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-12369"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331178"
},
{
"type": "PACKAGE",
"url": "https://github.com/wildfly-security/wildfly-elytron"
},
{
"type": "WEB",
"url": "https://issues.redhat.com/browse/ELY-2887"
}
],
"database_specific": {
"cwe_ids": [
"CWE-345"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-03-25T21:49:11Z",
"nvd_published_at": null
}
}