[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <528A7C4C.3010307@redhat.com>
Date: Mon, 18 Nov 2013 13:45:00 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Re: CVE request: RubyGem omniauth-facebook access
token security vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 11/18/2013 12:29 PM, Josef Šimánek wrote:
> Sorry for bumping, but is there any problem with this CVE request?
>
> Fix is here
> (https://github.com/mkdynamic/omniauth-facebook/commit/115c0a768cd6f4b9bfae8900f8e3fc4fbeec3ad8)
>
>
and release is prepared. We're waiting for CVE only.
>
> regards Josef
>
> 2013/11/15 Josef Šimánek <josef.simanek@...il.com>:
>> # RubyGem omniauth-facebook access token security vulnerability
>>
>> There is a security vulnerability in the omniauth-facebook <=
>> 1.5.0.
>>
>> Versions affected: <= 1.5.0 Fixed versions: >= 1.5.1
>>
>> ## Impact
>>
>> Because omniauth-facebook <= 1.5.0 supports passing an access
>> token directly in the URL, an attacker may be able to
>> authenticate as another user by passing a valid access token
>> obtained from Facebook for another app.
>>
>> If you're currently using this feature, and passing the access
>> token directly, you should change your integration to use one of
>> the secure methods using either a signed request or the code
>> flow. These secure methods are default, so unless you are
>> explicitly passing an access token you should not need to make
>> any integration changes to upgrade to 1.5.1.
>>
>> All users running an affected release should upgrade to >=
>> 1.5.1.
>>
>> ## Releases
>>
>> The 1.5.1 releases is available at the normal locations.
>>
>> ## Workarounds
>>
>> None.
>>
>> ## Credits
>>
>> Egor Homakov (@homakov)
Nope, I've been sick the last few days. Please use CVE-2013-4593 for
this issue.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)
iQIcBAEBAgAGBQJSinxMAAoJEBYNRVNeJnmTk5MQALRrwxUqrHd+rxhKUmDV8s/p
95lx/W+osKjKw+6pfGo5fF9plrz/tI0QPEPEwOjbrobmnixnOngA3YF9Y1exLKiF
aRl9gYz7UA4Ii3gSxvp54301QtYLSqe8iFC5xWW7+bCMAVgvCwkbHhHAR3gyMoT0
BN4KnmLuNK0oADfYHv1TlxrHWmAa+BvT2i+izIVdLpy3nZDJxaPSJvKsfXw0IKbg
xYoNSwuegonDdpe6HLmxjZE+vrmv7rii24kvrhDi0ZnkbUdkm5+1zMcFtZcS3ztc
SzcstDmtRF9+xUrZ1/G8XNrvkXJlrn5xlO1VeU+enF6ebltJcI2hUgFEjM9mGzoW
BSiNdvE4Dh1N5aHawxjfNQN9jcaAxkBxFUoEV+zkO3d6YLIq0nIr7S6wmz5fpONx
h136iYhHJMB91GMTWOUeHVvUCaTBOM4JZu1baUC2Gbnj94dmOTtsvWl9kuM3zwOf
wlvz1ZRAb/38SHDTB2V+W5xn8EEWUkLrX5PG/drhQxL4oov+U/lgwTYwcNOTWfe0
1pkUo6VzR098hmkXHctH7DmqaQ5OX+3U8eAucBwgq83sJx5UV4Rr0yApMLABUq+I
GNzBXpdkc2O7Id+HKRPrWHmU4V+fg5Fj/NsENswGboXPU2YmOLvxULRCVH2IV4dn
qD1ORTk+4jzb0ukBUwbo
=E8Hu
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
