GHSA-3m6r-39p3-jq25 CVE-2016-6582
Doorkeeper is vulnerable to replay attacks
- Severity
- 9.1 / 10
- Critical · CVSS 3.0
- Exploit chance (EPSS)
- 4.81%
- Chance of exploitation in the next 30 days. Higher than 91.97% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1254 Incorrect Comparison Logic Granularity
- Fix
4.2.0- Upgrade doorkeeper to this version or later
Description
The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| doorkeeper | < 4.2.0 |
4.2.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
doorkeeper RubyGems → 4.2.0
- bundler
bundle update doorkeeper # Gemfile: gem "doorkeeper", ">= 4.2.0"
Severity breakdown
CVSS 3.0 9.1
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Weakness
CWE-1254: Incorrect Comparison Logic Granularity
The product's comparison logic is performed over a series of steps rather than across the entire string in one operation. If there is a comparison logic failure on one of these steps, the operation may be vulnerable to a timing attack that can result in the interception of the process for nefarious purposes.
How to prevent it
- Implementation: The hardware designer should ensure that comparison logic is implemented so as to compare in one operation instead in smaller chunks.
References
Advisories
Other links
- github.com/doorkeeper-gem/doorkeeper/issues/875
- github.com/doorkeeper-gem/doorkeeper
- github.com/doorkeeper-gem/doorkeeper/releases/tag/v4.2.0
- github.com/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper/CVE-2016-6582.yml
- web.archive.org/web/20170214021758/http://www.securityfocus.com/bid/92551
- web.archive.org/web/20201207202519/http://www.securityfocus.com/archive/1/539268/100…
- packetstormsecurity.com/files/138430/Doorkeeper-4.1.0-Token-Revocation.html
- seclists.org/fulldisclosure/2016/Aug/105
- openwall.com/lists/oss-security/2016/08/19/2
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-7w2c-w47h-789w Doorkeeper Improper Authentication vulnerability | Medium | Also affects doorkeeper |
| GHSA-j7vx-8mqj-cqp9 Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper | High | Also affects doorkeeper |
| GHSA-685w-vc84-wxcx Doorkeeper vulnerable to Cross-site Request Forgery | Medium | Also affects doorkeeper |
| GHSA-694m-jhr9-pf77 Doorkeeper subject to Incorrect Permission Assignment | High | Also affects doorkeeper |
| GHSA-hwhh-2fwm-cfgw Doorkeeper is vulnerable to stored XSS and code execution | Medium | Also affects doorkeeper |
| GHSA-8fq3-c5w3-pj3q CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) | High | Same weakness, CWE-1254 |
| GHSA-4vxv-4xq4-p84h CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) | High | Same weakness, CWE-1254 |
| GHSA-xxvh-5hwj-42pp OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation | Low | Same weakness, CWE-1254 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor