com.clever-cloud:biscuit-pulsar (>=3.5.0, <=3.7.1), fr.maif:otoroshi_2.12 (>=16.17.0, <=16.22.0) potentially affected by CVE-2024-41948 via org.biscuitsec:biscuit (>=3.0.0, <=3.0.1)

org.biscuitsec:biscuit MAVEN version =3.0.0, =3.5.0, =16.17.0, =16.22.0 Source cves: CVE-2024-41948 Source advisory: GHSA-5HCJ-RWM6-XMW4...

GHSA-5HCJ-RWM6-XMW4 biscuit-java vulnerable to public key confusion in third party block

Impact Tokens with third-party blocks containing trusted annotations generated through a third party block request. Due to implementation issues in biscuit-java, third party block support in published versions is inoperating. Nevertheless, to synchronize with other implementations, we publish thi...

PT-2024-29887

Name of the Vulnerable Software and Affected Versions Biscuit versions prior to 4 Description The issue concerns the generation of third-party blocks in Biscuit, an authorization token with decentralized verification. A malicious user can forge a ThirdPartyBlock request, tricking the third-party...

PT-2024-29655 · Unknown · Biscuit-Java

Name of the Vulnerable Software and Affected Versions: biscuit-java versions prior to 4.0.0 Description: The issue concerns the generation of third-party blocks for authentication and authorization tokens in microservices architectures. A malicious user can forge a third-party block request,...

com.clever-cloud:biscuit-pulsar (>=2.2.2, <=2.3.0), org.apache.pulsar:pulsar-broker-auth-athenz (>=2.8.0, <=2.8.3) +3 more potentially affected by CVE-2022-33683 via org.apache.pulsar:pulsar-broker (>=2.8.0, <=2.8.3)

org.apache.pulsar:pulsar-broker MAVEN version =2.8.0, =2.2.2, =2.8.0, =2.8.0, =2.8.0, =2.8.0, =2.8.3 Source cves: CVE-2022-33683 Source advisory: OSV:GHSA-J3QW-G67Q-7M64...

com.clever-cloud:biscuit-pulsar (>=2.2.2, <=2.3.0), org.apache.pulsar:pulsar-broker-auth-athenz (>=2.8.0, <=2.8.3) +3 more potentially affected by CVE-2022-33682 via org.apache.pulsar:pulsar-broker (>=2.8.0, <=2.8.3)

org.apache.pulsar:pulsar-broker MAVEN version =2.8.0, =2.2.2, =2.8.0, =2.8.0, =2.8.0, =2.8.0, =2.8.3 Source cves: CVE-2022-33682 Source advisory: OSV:GHSA-JVF3-MFXV-JCQR...

com.clever-cloud:biscuit-pulsar (>=2.3.2, <=3.2.0), com.github.shoothzj:test-pulsar (>=3.1.7, <=3.1.11) +4 more potentially affected by CVE-2022-33682 via org.apache.pulsar:pulsar-broker (>=2.9.0, <=2.9.2)

org.apache.pulsar:pulsar-broker MAVEN version =2.9.0, =2.3.2, =3.1.7, =2.9.0, =2.9.0, =2.9.0, =2.9.0, =2.9.2 Source cves: CVE-2022-33682 Source advisory: OSV:GHSA-JVF3-MFXV-JCQR...

com.chatroulette:neutron-circe_2.12 (0.0.2), com.chatroulette:neutron-circe_2.13 (>=0.0.2, <=0.0.9) +150 more potentially affected by CVE-2022-33681 via org.apache.pulsar:pulsar-client (>=2.0.0-rc1-incubating, <=2.7.4)

org.apache.pulsar:pulsar-client MAVEN version =2.0.0-rc1-incubating, =0.0.2, =0.0.1, =0.0.1, =1.2.1, =1.0.0.m1, =1.0.0.m1, =1.0.3, =2.4.0-m7, =2.4.0-m10 and more Source cves: CVE-2022-33681 Source advisory: GHSA-C5FP-X2H5-VJV7...

com.clever-cloud:biscuit-pulsar (>=2.3.2, <=3.2.0), com.github.shoothzj:test-pulsar (>=3.1.7, <=3.1.11) +4 more potentially affected by CVE-2022-33683 via org.apache.pulsar:pulsar-broker (>=2.9.0, <=2.9.2)

org.apache.pulsar:pulsar-broker MAVEN version =2.9.0, =2.3.2, =3.1.7, =2.9.0, =2.9.0, =2.9.0, =2.9.0, =2.9.2 Source cves: CVE-2022-33683 Source advisory: MEND:CVE-2022-33683...

com.clever-cloud:biscuit-pulsar (>=2.2.2, <=2.3.0), org.apache.pulsar:pulsar-broker-auth-athenz (>=2.8.0, <=2.8.3) +3 more potentially affected by CVE-2022-33683 via org.apache.pulsar:pulsar-broker (>=2.8.0, <=2.8.3)

org.apache.pulsar:pulsar-broker MAVEN version =2.8.0, =2.2.2, =2.8.0, =2.8.0, =2.8.0, =2.8.0, =2.8.3 Source cves: CVE-2022-33683 Source advisory: MEND:CVE-2022-33683...

com.clever-cloud:biscuit-pulsar (3.2.1), com.github.shoothzj:test-pulsar (>=3.1.12, <=3.1.15) +6 more potentially affected by CVE-2022-33683 via org.apache.pulsar:pulsar-broker (2.10.0)

org.apache.pulsar:pulsar-broker MAVEN version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.pulsar:pulsar-broker and may be impacted: - com.clever-cloud:biscuit-pulsar 3.2.1 - com.github.shoothzj:test-pulsar =3.1.12, =0.0.1, =1.0.0,...

com.chatroulette:neutron-circe_2.12 (0.0.2), com.chatroulette:neutron-circe_2.13 (>=0.0.2, <=0.0.9) +163 more potentially affected by CVE-2022-33681 via org.apache.pulsar:pulsar-client (>=1.19.0-incubating, <=2.7.4)

org.apache.pulsar:pulsar-client MAVEN version =1.19.0-incubating, =0.0.2, =0.0.1, =0.0.1, =1.2.1, =1.0.0.m1, =1.0.0.m1, =1.0.3, =2.4.0-m7, =2.4.0-m10 and more Source cves: CVE-2022-33681 Source advisory: MEND:CVE-2022-33681...

GO-2022-0564 Signature forgery in github.com/biscuit-auth/biscuit-go

An attacker can forge Biscuit v1 tokens with any access level. There is no known workaround for Biscuit v1. The Biscuit v2 specification avoids this vulnerability...

Signature forgery in Biscuit

Impact The paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level. As Biscu...

com.clever-cloud:biscuit-pulsar (>=1.1.13, <=1.3.0), com.clever-cloud:integration-test (>=1.2.0, <=1.3.0) potentially affected by CVE-2022-31053 via com.clever-cloud:biscuit-java (0.2.7)

com.clever-cloud:biscuit-java MAVEN version 0.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.clever-cloud:biscuit-java and may be impacted: - com.clever-cloud:biscuit-pulsar =1.1.13, =1.2.0, =1.3.0 Source cves: CVE-2022-31053 Source advisory:...

fr.maif:otoroshi_2.12 (>=1.5.0-alpha.11, <=1.5.5) potentially affected by CVE-2022-31053 via com.clever-cloud:biscuit-java (1.1.0)

com.clever-cloud:biscuit-java MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.clever-cloud:biscuit-java and may be impacted: - fr.maif:otoroshi2.12 =1.5.0-alpha.11, =1.5.5 Source cves: CVE-2022-31053 Source advisory:...

com.clever-cloud:biscuit-pulsar (1.4.2) potentially affected by CVE-2022-31053 via com.clever-cloud:biscuit-java (0.3.0)

com.clever-cloud:biscuit-java MAVEN version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.clever-cloud:biscuit-java and may be impacted: - com.clever-cloud:biscuit-pulsar 1.4.2 Source cves: CVE-2022-31053 Source advisory:...

com.clever-cloud:biscuit-pulsar (>=2.0.1, <=2.0.2) potentially affected by CVE-2022-31053 via com.clever-cloud:biscuit-java (1.1.1)

com.clever-cloud:biscuit-java MAVEN version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.clever-cloud:biscuit-java and may be impacted: - com.clever-cloud:biscuit-pulsar =2.0.1, =2.0.2 Source cves: CVE-2022-31053 Source advisory:...

com.clever-cloud:biscuit-pulsar (>=2.0.3, <=2.3.0) potentially affected by CVE-2022-31053 via com.clever-cloud:biscuit-java (1.1.2)

com.clever-cloud:biscuit-java MAVEN version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.clever-cloud:biscuit-java and may be impacted: - com.clever-cloud:biscuit-pulsar =2.0.3, =2.3.0 Source cves: CVE-2022-31053 Source advisory:...

GHSA-75RW-34Q6-72CR Signature forgery in Biscuit

Impact The paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level. As Biscu...