Описание
The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload. The token will pass the validation on the client side. We recommend upgrading to version 1.33.3 or above
A flaw was found in Google OAuth Java client's IDToken verifier, where it does not verify if the token is properly signed. This issue could allow an attacker to provide a compromised token with a custom payload that will pass the validation on the client side, allowing access to information outside of their prescribed permissions.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Logging Subsystem for Red Hat OpenShift | google-oauth-client | Affected | ||
| Red Hat AMQ Broker 7 | google-oauth-client | Not affected | ||
| Red Hat build of Quarkus | google-oauth-client | Not affected | ||
| Red Hat Integration Camel K 1 | google-oauth-client | Not affected | ||
| Red Hat Integration Camel Quarkus 1 | google-oauth-client | Not affected | ||
| Red Hat Integration Data Virtualisation Operator | google-oauth-client | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 7 | google-oauth-client | Not affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | google-oauth-client | Not affected | ||
| Red Hat JBoss Fuse 6 | google-oauth-client | Out of support scope | ||
| Red Hat JBoss Fuse Service Works 6 | google-oauth-client | Out of support scope |
Показывать по
Дополнительная информация
Статус:
EPSS
7.3 High
CVSS3
Связанные уязвимости
The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload. The token will pass the validation on the client side. We recommend upgrading to version 1.33.3 or above
The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload. The token will pass the validation on the client side. We recommend upgrading to version 1.33.3 or above
The vulnerability is that IDToken verifier does not verify if token is ...
google-oauth-java-client improperly verifies cryptographic signature
EPSS
7.3 High
CVSS3