GO-2024-2844 vulnerabilities

Vulnerabilities for packages: grafana-fips...

GO-2024-2858 vulnerabilities

Vulnerabilities for packages: grafana-fips...

CVE-2023-36820

Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips aud claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut...

io.micronaut.security:micronaut-security-aot (3.11.0) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (3.11.0)

io.micronaut.security:micronaut-security-oauth2 MAVEN version 3.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut.security:micronaut-security-oauth2 and may be impacted: - io.micronaut.security:micronaut-security-aot 3.11.0 Source cves:...

io.micronaut.security:micronaut-security-aot (>=3.9.0, <=3.9.5) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (>=3.9.0, <=3.9.5)

io.micronaut.security:micronaut-security-oauth2 MAVEN version =3.9.0, =3.9.0, =3.9.5 Source cves: CVE-2023-36820 Source advisory: MEND:CVE-2023-36820...

io.micronaut.security:micronaut-security-aot (3.4.2) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (3.4.2)

io.micronaut.security:micronaut-security-oauth2 MAVEN version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut.security:micronaut-security-oauth2 and may be impacted: - io.micronaut.security:micronaut-security-aot 3.4.2 Source cves:...

CVE-2023-36820

Micronaut Security (io.micronaut.security: micronaut-security-oauth2) contains a vulnerability in IdTokenClaimsValidator where aud validation is skipped when a token is issued by the same issuer/provider. This affects multiple Micronaut OIDC setups where several applications share the same issuer...

io.archimedesfw.security:archimedes-security-auth-micronaut (>=0.2.0, <=0.2.1) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (3.8.3)

io.micronaut.security:micronaut-security-oauth2 MAVEN version 3.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut.security:micronaut-security-oauth2 and may be impacted: - io.archimedesfw.security:archimedes-security-auth-micronaut =0.2....

io.micronaut.security:micronaut-security-aot (3.11.0) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (3.11.0)

io.micronaut.security:micronaut-security-oauth2 MAVEN version 3.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut.security:micronaut-security-oauth2 and may be impacted: - io.micronaut.security:micronaut-security-aot 3.11.0 Source cves:...

io.archimedesfw.security:archimedes-security-auth-micronaut (>=0.2.0, <=0.2.1) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (3.8.3)

io.micronaut.security:micronaut-security-oauth2 MAVEN version 3.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut.security:micronaut-security-oauth2 and may be impacted: - io.archimedesfw.security:archimedes-security-auth-micronaut =0.2....

io.micronaut.security:micronaut-security-aot (>=3.10.0, <=3.10.1) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (>=3.10.0, <=3.10.1)

io.micronaut.security:micronaut-security-oauth2 MAVEN version =3.10.0, =3.10.0, =3.10.1 Source cves: CVE-2023-36820 Source advisory: GHSA-QW22-8W9R-864H...