Debian/buildbot: critical 9.8
Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user. If an attacker has a token allowing them to read the user details
Action: Upgrade buildbot to 2.0.1-2 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.1-2 | - |
Fixed versions
| 2.0.1-2 |
Sources
published · modified · JSON