com.clever-cloud:biscuit-pulsar (1.4.6), com.clever-cloud:integration-test (1.4.6) potentially affected by CVE-2022-31053 via com.clever-cloud:biscuit-java (0.3.1)

com.clever-cloud:biscuit-java MAVEN version 0.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.clever-cloud:biscuit-java and may be impacted: - com.clever-cloud:biscuit-pulsar 1.4.6 - com.clever-cloud:integration-test 1.4.6 Source cves:...

com.clever-cloud:biscuit-pulsar (2.3.2) potentially affected by CVE-2022-31053 via com.clever-cloud:biscuit-java (1.1.4)

com.clever-cloud:biscuit-java MAVEN version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.clever-cloud:biscuit-java and may be impacted: - com.clever-cloud:biscuit-pulsar 2.3.2 Source cves: CVE-2022-31053 Source advisory:...

Insecure Cryptographic Function

Biscuit has insecure cryptographic function. The vulnerability exists due to the use a signature algorithm which allows an attacker to forge Γ-signatures and create token with any access level to bypass authentication and authorization...

CVE-2022-31053

Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The...

CVE-2022-31053

CVE-2022-31053 involves Biscuit tokens where the v1 specification contains a vulnerable algorithm that allows forging valid Γ-signatures, enabling a token with any access level. The vulnerability does not affect Biscuit v2, which uses a different algorithm. Red Hat and OSV entries corroborate the...

CVE-2022-31053 Signature forgery in Biscuit

Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The...

CVE-2022-31053 Signature forgery in Biscuit

Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The...

CVE-2022-31053

Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The...

CVE-2022-31053 Signature forgery in Biscuit

Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The...

CVE-2022-31053: Improper Verification of Cryptographic Signature

Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The...

Biscuit data falsification vulnerability

Biscuit is delegated, decentralized, capability-based authorization tokens. A data forgery issue vulnerability exists in the v1 version of Biscuit that stems from allowing an attacker to create tokens with any access level...

PT-2022-20491

Name of the Vulnerable Software and Affected Versions Biscuit versions 1 Description The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. This would allow an attacker to create a token with any access level. The version 2 of...

boomerang (>=0.1.0, <=0.3.0), boomerang_builder (0.3.0) +13 more potentially affected by CVE-2021-1000007 +1 more via parse_duration (2.1.1)

parseduration CARGO version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on parseduration and may be impacted: - boomerang =0.1.0, =0.1.0, =1.0.0-alpha.3, =3.1.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.2.1, =0.3.2 - wait-until 1.0.0 Source cves:...