io.micronaut.security:micronaut-security-aot (3.11.0) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (3.11.0)

io.micronaut.security:micronaut-security-oauth2 MAVEN version 3.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut.security:micronaut-security-oauth2 and may be impacted: - io.micronaut.security:micronaut-security-aot 3.11.0 Source cves:...

io.micronaut.security:micronaut-security-aot (3.4.2) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (3.4.2)

io.micronaut.security:micronaut-security-oauth2 MAVEN version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut.security:micronaut-security-oauth2 and may be impacted: - io.micronaut.security:micronaut-security-aot 3.4.2 Source cves:...

io.micronaut.security:micronaut-security-aot (3.11.0) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (3.11.0)

io.micronaut.security:micronaut-security-oauth2 MAVEN version 3.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut.security:micronaut-security-oauth2 and may be impacted: - io.micronaut.security:micronaut-security-aot 3.11.0 Source cves:...

GHSA-QW22-8W9R-864H io.micronaut.security:micronaut-security-oauth2 has invalid IdTokenClaimsValidator logic on aud

Summary IdTokenClaimsValidator skips aud claim validation if token is issued by same identity issuer/provider. Details See https://github.com/micronaut-projects/micronaut-security/blob/master/security-oauth2/src/main/java/io/micronaut/security/oauth2/client/IdTokenClaimsValidator.javaL202 This...

io.micronaut.security:micronaut-security-aot (>=3.9.0, <=3.9.5) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (>=3.9.0, <=3.9.5)

io.micronaut.security:micronaut-security-oauth2 MAVEN version =3.9.0, =3.9.0, =3.9.5 Source cves: CVE-2023-36820 Source advisory: OSV:GHSA-QW22-8W9R-864H...

io.archimedesfw.security:archimedes-security-auth-micronaut (>=0.2.0, <=0.2.1) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (3.8.3)

io.micronaut.security:micronaut-security-oauth2 MAVEN version 3.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut.security:micronaut-security-oauth2 and may be impacted: - io.archimedesfw.security:archimedes-security-auth-micronaut =0.2....

io.micronaut.security:micronaut-security-aot (3.4.2) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (3.4.2)

io.micronaut.security:micronaut-security-oauth2 MAVEN version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut.security:micronaut-security-oauth2 and may be impacted: - io.micronaut.security:micronaut-security-aot 3.4.2 Source cves:...

io.micronaut.security:micronaut-security-aot (>=3.10.0, <=3.10.1) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (>=3.10.0, <=3.10.1)

io.micronaut.security:micronaut-security-oauth2 MAVEN version =3.10.0, =3.10.0, =3.10.1 Source cves: CVE-2023-36820 Source advisory: GHSA-QW22-8W9R-864H...

io.micronaut.security:micronaut-security-aot (>=3.10.0, <=3.10.1) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (>=3.10.0, <=3.10.1)

io.micronaut.security:micronaut-security-oauth2 MAVEN version =3.10.0, =3.10.0, =3.10.1 Source cves: CVE-2023-36820 Source advisory: OSV:GHSA-QW22-8W9R-864H...

PT-2023-25712 · Micronaut · Micronaut Security

Name of the Vulnerable Software and Affected Versions: Micronaut Security versions prior to 3.1.2 Micronaut Security versions prior to 3.2.4 Micronaut Security versions prior to 3.3.2 Micronaut Security versions prior to 3.4.3 Micronaut Security versions prior to 3.5.3 Micronaut Security versions...