[SECURITY] [DSA 4109-1] ruby-omniauth security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4109-1 [email protected] https://www.debian.org/security/ February 09, 2018 https://www.debian.org/security/faq - -------------------------------------------------------------------------...

[SECURITY] [DSA 4109-1] ruby-omniauth security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4109-1 [email protected] https://www.debian.org/security/ February 09, 2018 https://www.debian.org/security/faq - -------------------------------------------------------------------------...

Debian: Security Advisory (DSA-4109-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OmniAuth Information Disclosure Vulnerability

OmniAuth is a set of authentication system using Rack middleware implementation . An information disclosure vulnerability exists in the strategy.rb file in versions of OmniAuth prior to 1.3.2, which stems from the program failing to properly protect the authenticitytoken value. An attacker could...

Omniauth allows POST parameters to be stored in session

In strategy.rb in OmniAuth before 1.3.2, the authenticitytoken value is improperly protected because POST in addition to GET parameters are stored in the session and become available in the environment of the callback phase...

GHSA-9PR6-GRF4-X2FR Omniauth allows POST parameters to be stored in session

In strategy.rb in OmniAuth before 1.3.2, the authenticitytoken value is improperly protected because POST in addition to GET parameters are stored in the session and become available in the environment of the callback phase...

Session fixation

In strategy.rb in OmniAuth before 1.3.2, the authenticitytoken value is improperly protected because POST in addition to GET parameters are stored in the session and become available in the environment of the callback phase...

CVE-2017-18076

In strategy.rb in OmniAuth before 1.3.2, the authenticitytoken value is improperly protected because POST in addition to GET parameters are stored in the session and become available in the environment of the callback phase...

DEBIAN-CVE-2017-18076

In strategy.rb in OmniAuth before 1.3.2, the authenticitytoken value is improperly protected because POST in addition to GET parameters are stored in the session and become available in the environment of the callback phase...

CVE-2017-18076

In strategy.rb in OmniAuth before 1.3.2, the authenticitytoken value is improperly protected because POST in addition to GET parameters are stored in the session and become available in the environment of the callback phase...

CVE-2017-18076

In strategy.rb in OmniAuth before 1.3.2, the authenticitytoken value is improperly protected because POST in addition to GET parameters are stored in the session and become available in the environment of the callback phase...

UBUNTU-CVE-2017-18076

In strategy.rb in OmniAuth before 1.3.2, the authenticitytoken value is improperly protected because POST in addition to GET parameters are stored in the session and become available in the environment of the callback phase...

CVE-2017-18076

In strategy.rb in OmniAuth before 1.3.2, the authenticitytoken value is improperly protected because POST in addition to GET parameters are stored in the session and become available in the environment of the callback phase...

CVE-2017-18076

In strategy.rb in OmniAuth before 1.3.2, the authenticitytoken value is improperly protected because POST in addition to GET parameters are stored in the session and become available in the environment of the callback phase...

CVE-2017-18076

CVE-2017-18076 affects the OmniAuth Ruby library, specifically the code path in strategy.rb prior to version 1.3.2. The vulnerability stems from POST parameters being stored in the session in addition to GET parameters, which makes the authenticity_token (CSRF token) available in the callback pha...

Design/Logic Flaw

GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verifycertificates LDAP option was mentioned in the 9.4 release announcement. This issue occurred because code was not merged. This is related to use of the omniauth-ldap library and the gitlabomniauth-ldap gem...

CVE-2017-17716

Removed by vendor...

omniauth-facebook Cross-Site Request Forgery vulnerability

The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery CSRF attacks via the state parameter...

omniauth-oauth2 Cross-Site Request Forgery vulnerability

Cross-site request forgery CSRF vulnerability in the omniauth-oauth2 gem prior to 1.1.1 for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state...

GHSA-FGMX-8H93-26FH omniauth-oauth2 Cross-Site Request Forgery vulnerability

Cross-site request forgery CSRF vulnerability in the omniauth-oauth2 gem prior to 1.1.1 for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state...