PyPI/datasette-indieauth: critical
Implementation trusts the "me" field returned by the authorization server without verifying it
Action: Upgrade datasette-indieauth to 1.1 or later.
pip install datasette-indieauth==1.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.0 | 1.1 | - |
Fixed versions
| 1.1 |
Sources
- osv: GHSA-mjcr-rqjg-rhg3
- https://github.com/simonw/datasette-indieauth/security/advisories/GHSA-mjcr-rqjg-rhg3
- https://github.com/simonw/datasette-indieauth/commit/376c8804c6b0811852049229a24336fe5eb6a439
- https://github.com/simonw/datasette-indieauth
- https://pypi.org/project/datasette-indieauth
published · modified · JSON