UBUNTU-CVE-2018-1000211

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2018-1000211

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-1000211.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2018-1000211

Related

CVE-2018-1000211

Published

2018-07-13T18:29:00Z

Modified

2025-03-25T04:55:38Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.

References

Affected packages

Ubuntu:Pro:18.04:LTS / ruby-doorkeeper

Package

Name: ruby-doorkeeper
Purl: pkg:deb/ubuntu/ruby-doorkeeper@4.3.1-1ubuntu0.1~esm1?arch=source&distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.2.0-3

4.3.1-1

4.3.1-1ubuntu0.1~esm1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / ruby-doorkeeper

Package

Name: ruby-doorkeeper
Purl: pkg:deb/ubuntu/ruby-doorkeeper@4.4.2-1?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.4.2-1

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "ruby-doorkeeper",
            "binary_version": "4.4.2-1"
        }
    ],
    "ubuntu_priority": "medium"
}