RubyGems/doorkeeper CVE-2016-6582: critical 9.1, EPSS 4.81%

Doorkeeper is vulnerable to replay attacks

Action: Upgrade doorkeeper to 4.2.0 or later.

bundle update doorkeeper

Affected

Fixed versions

Sources

• osv: GHSA-3m6r-39p3-jq25
• https://nvd.nist.gov/vuln/detail/CVE-2016-6582
• https://github.com/doorkeeper-gem/doorkeeper/issues/875
• https://github.com/advisories/GHSA-3m6r-39p3-jq25
• https://github.com/doorkeeper-gem/doorkeeper
• https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v4.2.0
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper/CVE-2016-6582.yml
• https://web.archive.org/web/20170214021758/http://www.securityfocus.com/bid/92551
• https://web.archive.org/web/20201207202519/http://www.securityfocus.com/archive/1/539268/100/0/threaded
• http://packetstormsecurity.com/files/138430/Doorkeeper-4.1.0-Token-Revocation.html
• http://seclists.org/fulldisclosure/2016/Aug/105
• http://www.openwall.com/lists/oss-security/2016/08/19/2

CVE-2016-6582 · published 2017-10-24T18:33:35Z · modified 2024-02-16T08:07:34.056523Z · JSON