com.slack.api:bolt-micronaut (0.99.0), io.micronaut.configuration:micronaut-security-ldap (>=1.3.0, <=1.3.1) +8 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.3.0)

io.micronaut:micronaut-http-server MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - com.slack.api:bolt-micronaut 0.99.0 - io.micronaut.configuration:micronaut-security-ldap...

io.micronaut.configuration:micronaut-security-ldap (2.0.0.m1), io.micronaut.configuration:micronaut-security-oauth2 (2.0.0.m1) +6 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (2.0.0.m1)

io.micronaut:micronaut-http-server MAVEN version 2.0.0.m1 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.configuration:micronaut-security-ldap 2.0.0.m1 -...

io.micronaut.acme:micronaut-acme (2.1.0), io.micronaut.groovy:micronaut-multitenancy-gorm (2.2.0) +12 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (2.1.4)

io.micronaut:micronaut-http-server MAVEN version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.acme:micronaut-acme 2.1.0 - io.micronaut.groovy:micronaut-multitenancy-gorm...

io.micronaut.security:micronaut-security (2.5.0), io.micronaut.security:micronaut-security-jwt (2.5.0) +6 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (2.5.5)

io.micronaut:micronaut-http-server MAVEN version 2.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.security:micronaut-security 2.5.0 - io.micronaut.security:micronaut-security-j...

CVE-2023-36820

Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips aud claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut...

Code injection

Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips aud claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut...

CVE-2023-36820 micronaut security has invalid IdTokenClaimsValidator logic on aud

Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips aud claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut...

CVE-2023-36820

Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips aud claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut...

io.micronaut.security:micronaut-security-aot (3.4.2) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (3.4.2)

io.micronaut.security:micronaut-security-oauth2 MAVEN version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut.security:micronaut-security-oauth2 and may be impacted: - io.micronaut.security:micronaut-security-aot 3.4.2 Source cves:...

CVE-2023-36820 micronaut security has invalid IdTokenClaimsValidator logic on aud

Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips aud claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut...

CVE-2023-36820

Micronaut Security (io.micronaut.security: micronaut-security-oauth2) contains a vulnerability in IdTokenClaimsValidator where aud validation is skipped when a token is issued by the same issuer/provider. This affects multiple Micronaut OIDC setups where several applications share the same issuer...

CVE-2023-36820 micronaut security has invalid IdTokenClaimsValidator logic on aud

Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips aud claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut...

io.micronaut.security:micronaut-security-aot (3.11.0) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (3.11.0)

io.micronaut.security:micronaut-security-oauth2 MAVEN version 3.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut.security:micronaut-security-oauth2 and may be impacted: - io.micronaut.security:micronaut-security-aot 3.11.0 Source cves:...

io.archimedesfw.security:archimedes-security-auth-micronaut (>=0.2.0, <=0.2.1) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (3.8.3)

io.micronaut.security:micronaut-security-oauth2 MAVEN version 3.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut.security:micronaut-security-oauth2 and may be impacted: - io.archimedesfw.security:archimedes-security-auth-micronaut =0.2....

io.micronaut.security:micronaut-security-aot (>=3.10.0, <=3.10.1) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (>=3.10.0, <=3.10.1)

io.micronaut.security:micronaut-security-oauth2 MAVEN version =3.10.0, =3.10.0, =3.10.1 Source cves: CVE-2023-36820 Source advisory: MEND:CVE-2023-36820...

io.micronaut.security:micronaut-security-aot (>=3.9.0, <=3.9.5) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (>=3.9.0, <=3.9.5)

io.micronaut.security:micronaut-security-oauth2 MAVEN version =3.9.0, =3.9.0, =3.9.5 Source cves: CVE-2023-36820 Source advisory: MEND:CVE-2023-36820...

Micronaut Security Access Control Error Vulnerability

Micronaut Security is a Micronaut Framework open source application security solution. Micronaut Security versions 3.11.0 to 3.11.1 , 3.10.0 to 3.10.2 , 3.9.0 to 3.9.6 , 3.8.0 to 3.8.4 , 3.7.0 to 3.7.4 , 3.6.0 to 3.6.6 , 3.5.0 to 3.5.3 , 3.4.0 to 3.4.3 An access control error vulnerability exists...

CVE-2023-36820: Improper Access Control

Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips aud claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut...

GHSA-QW22-8W9R-864H io.micronaut.security:micronaut-security-oauth2 has invalid IdTokenClaimsValidator logic on aud

Summary IdTokenClaimsValidator skips aud claim validation if token is issued by same identity issuer/provider. Details See https://github.com/micronaut-projects/micronaut-security/blob/master/security-oauth2/src/main/java/io/micronaut/security/oauth2/client/IdTokenClaimsValidator.javaL202 This...

io.archimedesfw.security:archimedes-security-auth-micronaut (>=0.2.0, <=0.2.1) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (3.8.3)

io.micronaut.security:micronaut-security-oauth2 MAVEN version 3.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut.security:micronaut-security-oauth2 and may be impacted: - io.archimedesfw.security:archimedes-security-auth-micronaut =0.2....