CVE-2024-41949 biscuit-rust vulnerable to public key confusion in third party block

biscuit-rust is the Rust implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock request can be sent, providing only the...

CVE-2024-41949 biscuit-rust vulnerable to public key confusion in third party block

biscuit-rust is the Rust implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock request can be sent, providing only the...

CVE-2024-41949

Biscuit-rust is affected by a public key confusion in third-party blocks. A forged ThirdPartyBlock request can trick a third-party authority into generating datalog that trusts the wrong keypair, enabling under-specified trust relationships. The issue is described across multiple sources (CVE-202...

CVE-2024-41949 biscuit-rust vulnerable to public key confusion in third party block

biscuit-rust is the Rust implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock request can be sent, providing only the...

biscuit-rust 安全漏洞

biscuit-rust is a Rust implementation of the Biscuit authorization token from the biscuit-auth open source. A security vulnerability exists in biscuit-rust version 4, which stems from the fact that a malicious user's spoofed third-party block request can trick a third-party organization into...

biscuit-java 安全漏洞

biscuit-java is a Java implementation of Biscuit authentication and authorization tokens from the biscuit-auth open source. A security vulnerability exists in biscuit-java version 3, which stems from a malicious user's spoofed third-party block request that can trick a third-party organization in...

GHSA-P9W4-585H-G3C7 biscuit-auth vulnerable to public key confusion in third party block

Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock request can be sent, providing only the necessary info to generate a third-party block and to sign it: - the public key of the previous block used in the signature - t...

biscuit-cli (>=0.4.1, <=0.4.2) potentially affected by CVE-2024-41949 +1 more via biscuit-auth (4.1.1)

biscuit-auth CARGO version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on biscuit-auth and may be impacted: - biscuit-cli =0.4.1, =0.4.2 Source cves: CVE-2024-41949, CVE-2024-42350 Source advisory: OSV:GHSA-P9W4-585H-G3C7...

GHSA-5HCJ-RWM6-XMW4 biscuit-java vulnerable to public key confusion in third party block

Impact Tokens with third-party blocks containing trusted annotations generated through a third party block request. Due to implementation issues in biscuit-java, third party block support in published versions is inoperating. Nevertheless, to synchronize with other implementations, we publish thi...

PT-2024-29887

Name of the Vulnerable Software and Affected Versions Biscuit versions prior to 4 Description The issue concerns the generation of third-party blocks in Biscuit, an authorization token with decentralized verification. A malicious user can forge a ThirdPartyBlock request, tricking the third-party...

PT-2024-29655 · Unknown · Biscuit-Java

Name of the Vulnerable Software and Affected Versions: biscuit-java versions prior to 4.0.0 Description: The issue concerns the generation of third-party blocks for authentication and authorization tokens in microservices architectures. A malicious user can forge a third-party block request,...

GO-2022-0564 Signature forgery in github.com/biscuit-auth/biscuit-go

An attacker can forge Biscuit v1 tokens with any access level. There is no known workaround for Biscuit v1. The Biscuit v2 specification avoids this vulnerability...

Signature forgery in Biscuit

Impact The paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level. As Biscu...

GHSA-75RW-34Q6-72CR Signature forgery in Biscuit

Impact The paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level. As Biscu...

files (>=1.0.0, <=2.2.3), portal (>=2.0.0, <=3.0.1) potentially affected by CVE-2022-31053 via biscuit-auth (1.2.0)

biscuit-auth CARGO version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on biscuit-auth and may be impacted: - files =1.0.0, =2.0.0, =3.0.1 Source cves: CVE-2022-31053 Source advisory: OSV:GHSA-75RW-34Q6-72CR...

Insecure Cryptographic Function

Biscuit has insecure cryptographic function. The vulnerability exists due to the use a signature algorithm which allows an attacker to forge Γ-signatures and create token with any access level to bypass authentication and authorization...

CVE-2022-31053

Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The...

CVE-2022-31053 Signature forgery in Biscuit

Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The...

CVE-2022-31053 Signature forgery in Biscuit

Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The...

CVE-2022-31053

CVE-2022-31053 involves Biscuit tokens where the v1 specification contains a vulnerable algorithm that allows forging valid Γ-signatures, enabling a token with any access level. The vulnerability does not affect Biscuit v2, which uses a different algorithm. Red Hat and OSV entries corroborate the...