CVE-2020-15222
Description
In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authentication the uniqueness of the jti value is not checked. When using client authentication method "private_key_jwt", OpenId specification says the following about assertion jti: "A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties". Hydra does not seem to check the uniqueness of this jti value. This problem is fixed in version 0.31.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/ory/fositeGo | < 0.31.0 | 0.31.0 |
Affected products
3Patches
Vulnerability mechanics
References
7- github.com/ory/fosite/commit/0c9e0f6d654913ad57c507dd9a36631e1858a3e9nvdPatchThird Party AdvisoryWEB
- github.com/ory/fosite/security/advisories/GHSA-v3q9-2p3m-7g43nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-v3q9-2p3m-7g43ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-15222ghsaADVISORY
- openid.net/specs/openid-connect-core-1_0.htmlnvdThird Party AdvisoryWEB
- github.com/ory/fosite/releases/tag/v0.31.0ghsaWEB
- pkg.go.dev/vuln/GO-2021-0110ghsaWEB
News mentions
0No linked articles in our index yet.