GHSA-5p9f-55j8-922m

Moderate severity vulnerability that affects doorkeeper

Medium Withdrawn Jun 17, 2020 RubyGems

Severity: Medium; The publisher's own rating, not a CVSS score
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 4.2.0; Upgrade doorkeeper to this version or later

Description

Withdrawn, accidental duplicate publish.

The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.

Affected versions

RubyGems

Package	Vulnerable	Fixed in
doorkeeper	`>= 1.2.0, < 4.2.0`	`4.2.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

doorkeeper RubyGems → `4.2.0`

bundler

bundle update doorkeeper # Gemfile: gem "doorkeeper", ">= 4.2.0"

References

Advisories

Timeline

Aug 13, 2018 Published
Jun 17, 2020 Withdrawn
Dec 2, 2024 Last updated by the source

Advisory	Severity	Why it's related
GHSA-7w2c-w47h-789w Doorkeeper Improper Authentication vulnerability	Medium	Also affects doorkeeper
GHSA-j7vx-8mqj-cqp9 Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper	High	Also affects doorkeeper
GHSA-685w-vc84-wxcx Doorkeeper vulnerable to Cross-site Request Forgery	Medium	Also affects doorkeeper
GHSA-694m-jhr9-pf77 Doorkeeper subject to Incorrect Permission Assignment	High	Also affects doorkeeper
GHSA-hwhh-2fwm-cfgw Doorkeeper is vulnerable to stored XSS and code execution	Medium	Also affects doorkeeper
GHSA-3m6r-39p3-jq25 Doorkeeper is vulnerable to replay attacks	Critical	Also affects doorkeeper

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor