GHSA-6hc9-cf8x-hf83

Source

https://github.com/advisories/GHSA-6hc9-cf8x-hf83

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-6hc9-cf8x-hf83/GHSA-6hc9-cf8x-hf83.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6hc9-cf8x-hf83

Aliases

CVE-2023-1584

Published

2023-10-04T12:30:14Z

Modified

2024-05-03T18:46:16.192438Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Quarkus OIDC can leak both ID and access tokens

Details

A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provider services. Please note that passwords are not stored in access tokens.

Database specific

{
    "nvd_published_at": "2023-10-04T11:15:09Z",
    "cwe_ids": [
        "CWE-200"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-04T18:49:34Z"
}

References

Affected packages

Maven / io.quarkus:quarkus-oidc

Package

Name: io.quarkus:quarkus-oidc; View open source insights on deps.dev
Purl: pkg:maven/io.quarkus/quarkus-oidc

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.13.0.Final

Affected versions

0.*

0.24.0

0.25.0

0.26.0

0.26.1

0.27.0

0.28.0

0.28.1

1.*

1.0.0.CR1

1.0.0.CR2

1.0.0.Final

1.0.1.Final

1.1.0.CR1

1.1.0.Final

1.1.1.Final

1.2.0.CR1

1.2.0.Final

1.2.1.Final

1.3.0.Alpha1

1.3.0.Alpha2

1.3.0.CR1

1.3.0.CR2

1.3.0.Final

1.3.1.Final

1.3.2.Final

1.3.3.Final

1.3.4.Final

1.4.0.CR1

1.4.0.Final

1.4.1.Final

1.4.2.Final

1.5.0.CR1

1.5.0.Final

1.5.1.Final

1.5.2.Final

1.6.0.CR1

1.6.0.Final

1.6.1.Final

1.7.0.CR1

1.7.0.CR2

1.7.0.Final

1.7.1.Final

1.7.2.Final

1.7.3.Final

1.7.4.Final

1.7.5.Final

1.7.6.Final

1.8.0.CR1

1.8.0.Final

1.8.1.Final

1.8.2.Final

1.8.3.Final

1.9.0.CR1

1.9.0.Final

1.9.1.Final

1.9.2.Final

1.10.0.CR1

1.10.0.Final

1.10.1.Final

1.10.2.Final

1.10.3.Final

1.10.4.Final

1.10.5.Final

1.11.0.Beta1

1.11.0.Beta2

1.11.0.CR1

1.11.0.Final

1.11.1.Final

1.11.2.Final

1.11.3.Final

1.11.4.Final

1.11.5.Final

1.11.6.Final

1.11.7.Final

1.12.0.CR1

1.12.0.Final

1.12.1.Final

1.12.2.Final

1.13.0.CR1

1.13.0.Final

1.13.1.Final

1.13.2.Final

1.13.3.Final

1.13.4.Final

1.13.5.Final

1.13.6.Final

1.13.7.Final

2.*

2.0.0.Alpha1

2.0.0.Alpha2

2.0.0.Alpha3

2.0.0.CR1

2.0.0.CR2

2.0.0.CR3

2.0.0.Final

2.0.1.Final

2.0.2.Final

2.0.3.Final

2.1.0.CR1

2.1.0.Final

2.1.1.Final

2.1.2.Final

2.1.3.Final

2.1.4.Final

2.2.0.CR1

2.2.0.Final

2.2.1.Final

2.2.2.Final

2.2.3.Final

2.2.4.Final

2.2.5.Final

2.3.0.CR1

2.3.0.Final

2.3.1.Final

2.4.0.CR1

2.4.0.Final

2.4.1.Final

2.4.2.Final

2.5.0.CR1

2.5.0.Final

2.5.1.Final

2.5.2.Final

2.5.3.Final

2.5.4.Final

2.6.0.CR1

2.6.0.Final

2.6.1.Final

2.6.2.Final

2.6.3.Final

2.7.0.CR1

2.7.0.Final

2.7.1.Final

2.7.2.Final

2.7.3.Final

2.7.4.Final

2.7.5.Final

2.7.6.Final

2.7.7.Final

2.8.0.CR1

2.8.0.Final

2.8.1.Final

2.8.2.Final

2.8.3.Final

2.9.0.CR1

2.9.0.Final

2.9.1.Final

2.9.2.Final

2.10.0.CR1

2.10.0.Final

2.10.1.Final

2.10.2.Final

2.10.3.Final

2.10.4.Final

2.11.0.CR1

2.11.0.Final

2.11.1.Final

2.11.2.Final

2.11.3.Final

2.12.0.CR1

2.12.0.Final

2.12.1.Final

2.12.2.Final

2.12.3.Final

2.13.0.CR1

Maven / io.quarkus:quarkus-oidc

Package

Name: io.quarkus:quarkus-oidc; View open source insights on deps.dev
Purl: pkg:maven/io.quarkus/quarkus-oidc

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.0

Fixed

3.1.0.Final

Affected versions

3.*

3.0.0.Final

3.0.1.Final

3.0.2.Final

3.0.3.Final

3.0.4.Final

3.1.0.CR1