GHSA-xhw6-hjc9-679m

Source

https://github.com/advisories/GHSA-xhw6-hjc9-679m

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-xhw6-hjc9-679m/GHSA-xhw6-hjc9-679m.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xhw6-hjc9-679m

Aliases

CVE-2021-44878

Published

2022-01-08T00:36:05Z

Modified

2024-02-16T08:23:56.582364Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

Pac4j token validation bypass if OpenID Connect provider supports none algorithm

Details

If an OpenID Connect provider supports the “none” algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it without an explicit configuration on its side or for the “idtoken” response type which is not secure and violates the OpenID Core Specification. The "none" algorithm does not require any signature verification when validating the ID tokens, which allows the attacker to bypass the token validation by injecting a malformed ID token using "none" as the value of "alg" key in the header with an empty signature value.

Database specific

{
    "nvd_published_at": "2022-01-06T13:15:00Z",
    "cwe_ids": [
        "CWE-347"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-07T22:41:34Z"
}

References

Affected packages

Maven / org.pac4j:pac4j-oidc

Package

Name: org.pac4j:pac4j-oidc; View open source insights on deps.dev
Purl: pkg:maven/org.pac4j/pac4j-oidc

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.5.5

Affected versions

1.*

1.7.0

1.7.1

1.7.2

1.8.0-RC1

1.8.0

1.8.1

1.8.2

1.8.3

1.8.4

1.8.5

1.8.6

1.8.7

1.8.8

1.8.9

1.9.0

1.9.1

1.9.2

1.9.3

1.9.4

1.9.5

1.9.6

1.9.7

1.9.8

1.9.9

2.*

2.0.0-RC1

2.0.0-RC2

2.0.0

2.1.0

2.2.0

2.2.1

2.3.0

2.3.1

3.*

3.0.0-RC1

3.0.0-RC2

3.0.0

3.0.1

3.0.2

3.1.0

3.2.0

3.3.0

3.4.0

3.5.0

3.6.0

3.6.1

3.7.0

3.8.0

3.8.1

3.8.2

3.8.3

3.9.0

4.*

4.0.0-RC1

4.0.0-RC2

4.0.0-RC3

4.0.0

4.0.1

4.0.2

4.0.3

4.1.0

4.2.0

4.3.0

4.3.1

4.4.0

4.5.0

4.5.1

4.5.2

4.5.3

4.5.4

Maven / org.pac4j:pac4j-oidc

Package

Name: org.pac4j:pac4j-oidc; View open source insights on deps.dev
Purl: pkg:maven/org.pac4j/pac4j-oidc

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.0

Fixed

5.3.1

Affected versions

5.*

5.0.0

5.0.1

5.1.0

5.1.1

5.1.2

5.1.3

5.1.4

5.1.5

5.2.0

5.2.1

5.3.0