https://bugzilla.redhat.com/show_bug.cgi?id=2545812
Bug ID: 2545812
Summary: CVE-2026-72887 perl-Net-OAuth: Net::OAuth::Client:
Session fixation via OAuth 1.0a downgrade [epel-all]
Product: Fedora EPEL
Version: epel10
Status: NEW
Whiteboard: {"flaws": ["d277978f-c5ae-4276-a948-07c9d3621b4c"]}
Component: perl-Net-OAuth
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected],
[email protected],
[email protected], [email protected]
Blocks: 2517237
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
Net::OAuth::Client versions before 0.32 for Perl allow the service provider to
silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token.
Passing a callback to the constructor selects OAuth 1.0a. get_request_token
then revokes that choice when the request token response omits
oauth_callback_confirmed, with no exception, no warning and no option to
require 1.0a. The access token request is built from the OAuth 1.0 message
class, which has no verifier parameter, so oauth_verifier is dropped from the
request even when get_access_token was passed one.
oauth_verifier is the binding that OAuth 1.0a added between the authorization
step and the token exchange. An application that asked for 1.0a and gets 1.0 is
open to OAuth 1.0 session fixation, where an attacker obtains a request token,
has the victim authorize it, and then completes the exchange themselves,
linking the victim's provider account to a session the attacker controls. No
attacker action sets up the downgrade: a provider that does not confirm the
callback is enough.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2545812
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202545812%23c0
--
_______________________________________________
perl-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
