CVE-2023-50708
1 advisory.
Packagist/yiisoft/yii2-authclient CVE-2023-50708: unknown 0
yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation
Action: Upgrade yiisoft/yii2-authclient to 2.2.15 or later.
composer require yiisoft/yii2-authclient:2.2.15Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.2.15 | - |
Fixed versions
| 2.2.15 |
Sources
- osv: GHSA-w8vh-p74j-x9xp
- https://github.com/yiisoft/yii2-authclient/security/advisories/GHSA-w8vh-p74j-x9xp
- https://nvd.nist.gov/vuln/detail/CVE-2023-50708
- https://github.com/yiisoft/yii2-authclient/commit/dabddf2154ab7e7703740205a069202554089248
- https://github.com/yiisoft/yii2-authclient
- https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth1.php#L158
- https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth2.php#L121
- https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OpenIdConnect.php#L420
CVE-2023-50708 · published · modified · JSON