CVE-2023-36820
1 advisory.
Maven/io.micronaut.security:micronaut-security-oauth2 CVE-2023-36820: medium 6.5
io.micronaut.security:micronaut-security-oauth2 has invalid IdTokenClaimsValidator logic on aud
Action: Upgrade io.micronaut.security:micronaut-security-oauth2 to the fixed version for your line (see fixed_versions).
Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.11.0 | 3.11.1 | - |
| 3.10.0 | 3.10.2 | - |
| 3.9.0 | 3.9.6 | - |
| 3.8.0 | 3.8.4 | - |
| 3.7.0 | 3.7.4 | - |
| 3.6.0 | 3.6.6 | - |
| 3.5.0 | 3.5.3 | - |
| 3.4.0 | 3.4.3 | - |
| 3.3.0 | 3.3.2 | - |
| 3.2.0 | 3.2.4 | - |
| 3.1.0 | 3.1.2 | - |
Fixed versions
| 3.11.1 | 3.10.2 | 3.9.6 | 3.8.4 | 3.7.4 | 3.6.6 | 3.5.3 | 3.4.3 | 3.3.2 | 3.2.4 | 3.1.2 |
Sources
- osv: GHSA-qw22-8w9r-864h
- https://github.com/micronaut-projects/micronaut-security/security/advisories/GHSA-qw22-8w9r-864h
- https://nvd.nist.gov/vuln/detail/CVE-2023-36820
- https://github.com/micronaut-projects/micronaut-security/commit/9728b925221a0d87798ccf250657a3c214b7e980
- https://github.com/micronaut-projects/micronaut-security
- https://github.com/micronaut-projects/micronaut-security/blob/master/security-oauth2/src/main/java/io/micronaut/security/oauth2/client/IdTokenClaimsValidator.java#L202
CVE-2023-36820 · published · modified · JSON