Your message dated Mon, 25 May 2020 14:56:41 +0530
with message-id <hkrvaq.gdma5frpk7...@onenetbeyond.org>
and subject line fixed in last upload
has caused the Debian Bug report #959903,
regarding ruby-doorkeeper: CVE-2020-10187
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
959903: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=959903
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: ruby-doorkeeper
Version: 5.0.2-2
Severity: grave
Tags: security upstream
Hi,
The following vulnerability was published for ruby-doorkeeper.
CVE-2020-10187[0]:
| Doorkeeper version 5.0.0 and later contains an information disclosure
| vulnerability that allows an attacker to retrieve the client secret
| only intended for the OAuth application owner. After authorizing the
| application and allowing access, the attacker simply needs to request
| the list of their authorized applications in a JSON format (usually
| GET /oauth/authorized_applications.json). An application is vulnerable
| if the authorized applications controller is enabled.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2020-10187
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10187
[1]
https://github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-j7vx-8mqj-cqp9
[2]
https://github.com/doorkeeper-gem/doorkeeper/commit/25d038022c2fcad45af5b73f9d003cf38ff491f6
Please adjust the affected versions in the BTS as needed. It is said
that it only affects versions >= 5.0.0, but this needs to be checked
yet (and why).
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
fixed 959903 5.0.3-1
thanks
fixed in last upload, but did not see the bug before upload, so
changelog is missing this info.
--- End Message ---
_______________________________________________
Pkg-ruby-extras-maintainers mailing list
Pkg-ruby-extras-maintainers@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-ruby-extras-maintainers
