Eclipse CSI - PIA resource management error vulnerability

Eclipse CSI – Versions 0.8.0 and earlier contain a resource management error vulnerability. This vulnerability arises because pre-authentication OIDC discovery and JWKS retrieval run concurrently within the asyncio event loop; an unauthenticated request can thus cause the entire service to hang...

Eclipse CSI - PIA server request forgery vulnerability

Eclipse CSI – Versions 0.8.0 and earlier contain a server-side request forgery vulnerability. This vulnerability arises because the verifytoken function fails to parse the jwksuri in OIDC discovery documents as a URL, fails to compare it with the source of an approved issuer, and does not enforce...