PT-2026-74065

TuxCare rebuilt 7 com.google.oauth-client packages to address 1 CVE. Fixed in 1.25.0-tuxcare.2...

PT-2026-73742

TuxCare rebuilt 7 com.google.oauth-client packages to address 2 CVEs. Fixed in 1.25.0-tuxcare.1...

google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can lead to improper authorization

PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized...

ai.deepsense:seahorse-executor-deeplang_2.11 (>=1.4.2, <=1.4.3), ai.h2o:h2o-persist-gcs (>=3.20.0.1, <=3.32.1.5) +1920 more potentially affected by CVE-2020-7692 via com.google.oauth-client:google-oauth-client (>=1.5.0-alpha, <=1.30.6)

com.google.oauth-client:google-oauth-client MAVEN version =1.5.0-alpha, =1.4.2, =3.20.0.1, =2.1.44, =3.30.0.5-1-3.0, =2.1.44, =3.30.0.5-1-3.0, =2.1.44, =3.30.0.5-1-3.0, =2.1.44, =0.1.2, =19.9.0, =19.9.0, =19.9.0, =19.9.1, =19.9.0, =20.3.2-2 and more Source cves: CVE-2020-7692 Source advisory:...

CVE-2020-7692: Incorrect Authorization

PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized...