evolution security, bug fix, and enhancement update

evolution 3.28.5-16 - Resolves: 1902630 Crash on file drag into mail composer with WebKitGTK 2.30 3.28.5-15 - Resolves: 1883619 ECalendarItem: Settings loaded only when being shown evolution-data-server 3.28.5-15 - Resolves: 1862403 CVE-2020-16117: Crash on malformed server response with minimal...

OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses

Impact fosite400 released as v0.30.2 introduced a new feature for handling redirect URLs pointing to loopback interfaces rfc8252section-7.3. As part of that change new behavior was introduced which failed to respect the redirect URL's only for loopback interfaces! query parameters 1. Registering ...

GHSA-RFQ3-W54C-F9Q5 OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses

Impact fosite400 released as v0.30.2 introduced a new feature for handling redirect URLs pointing to loopback interfaces rfc8252section-7.3. As part of that change new behavior was introduced which failed to respect the redirect URL's only for loopback interfaces! query parameters 1. Registering ...

OPENSUSE-SU-2021:0675-1 Security update for alpine

This update for alpine fixes the following issues: Update to release 2.24 A few crash fixes Implementation of XOAUTH2 for Yahoo! Mail. Update to release 2.23.2 Expansion of the configuration screen for XOAUTH2 to include username, and tenant. Alpine uses the domain in the From: header of a messag...

Code Injection

Overview oauth2-server aka node-oauth2-server through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid...

XML External Entity (XXE)

oauth2-oidc-sdk is vulnerable to XML external entity XXE attacks.The parse function in SAML2AssertionValidator.java does not disable access to external entities by default, allowing an attacker to submit a malicious XML document to perform requests on behalf of the server...

@abramltd/jwt-oauth2-middleware (0.1.0), @aerocorp/cli (7.0.5) +143 more potentially affected by CVE-2017-18924 via oauth2-server (>=3.0.0, <=3.1.1)

oauth2-server NPM version =3.0.0, =1.0.0, =0.0.1, =2.1.0, =3.0.0, =0.4.1, =0.1.0, =3.0.0, =3.0.0, =3.5.8 and more Source cves: CVE-2017-18924 Source advisory: OSV:GHSA-2FW4-MGQ9-39CX...

Code Injection in oauth2-server

"oauth2-server aka node-oauth2-server through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid and not...

GHSA-2FW4-MGQ9-39CX Code Injection in oauth2-server

"oauth2-server aka node-oauth2-server through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid and not...

LY Corporation: Reflected XSS in OAUTH2 login flow (https://access.line.me)

Vulnerability description not provided...

OAuth2 Proxy Access Control Error Vulnerability

OAuth2 Proxy is a reverse proxy that provides authentication with Google, Github or other providers. OAuth2 Proxy suffers from an access control error vulnerability that stems from the fact that none of the authorizations are restricted. No details of the vulnerability are available at this time...

CVE-2021-21411

OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The --gitlab-group flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardless of the flag settings, authorization wasn't restricted...

CVE-2021-21411

OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The --gitlab-group flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardless of the flag settings, authorization wasn't restricted...

CVE-2021-21411

OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The --gitlab-group flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardless of the flag settings, authorization wasn't restricted...

Authorization

OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The --gitlab-group flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardless of the flag settings, authorization wasn't restricted...

CVE-2021-21411

OAuth2-Proxy suffered a vulnerability where the --gitlab-group flag for GitLab-group-based authorization stopped working in v7.0.0. Regardless of the flag, authorization wasn’t restricted and an authenticated user’s groups were added to X-Forwarded-Groups upstream. A bug caused the user session’s...

CVE-2021-21411 Incorrect authorization in OAuth2-Proxy

OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The --gitlab-group flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardless of the flag settings, authorization wasn't restricted...

CVE-2021-21411

OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The "--gitlab-group" flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardless of the flag settings, authorization wasn't restricted...

OAuth2-Proxy 访问控制错误漏洞

OAuth2 Proxy is a reverse proxy that provides authentication with Google, Github or other providers. OAuth2 Proxy suffers from an access control error vulnerability that stems from the fact that none of the authorizations are restricted. No details of the vulnerability are available at this time...

PT-2021-14486

Name of the Vulnerable Software and Affected Versions OAuth2-Proxy versions 7.0.0 through 7.0.x Description The --gitlab-group flag for group-based authorization in the GitLab provider stopped working, allowing any authenticated users to access applications regardless of --gitlab-group membership...