GHSA-HHW9-35P2-Q2C5严重已审查

Steam Socialite Provider v1 does not correctly validate openid server

OSV 1.4.0 · github-reviewed · 修改于 2021-01-30 04:39

发布时间

2021-01-30 04:51

GitHub 审查时间

2021-01-30 04:39

NVD 发布时间

—

源文件

advisories/github-reviewed/2021/01/GHSA-hhw9-35p2-q2c5/GHSA-hhw9-35p2-q2c5.json

公告说明

Impact

The outdated version 1 of the Steam Socialite Provider doesn't check properly if the login comes from steamcommunity.com, allowing a malicious actor to substitute their own openID server.

Patches

This vulnerability only affects the outdated v1.x versions of the package. These are no longer maintained, users should upgrade to v3 or v4, which use a hardcoded endpoint to verify the login.

For more information

If you have any questions or comments about this advisory:

Open an issue in SocialiteProviders/Providers
Email us at [email protected]

受影响的软件包

Packagist

socialiteproviders/steam

ECOSYSTEM

标识信息

别名 / CVE

无

CWE

CWE-346

软件生态

Packagist

扩展资料

暂无扩展资料。

CVSS 评分

没有 CVSS 数据。

原始 OSV JSON

{
  "id": "GHSA-hhw9-35p2-q2c5",
  "aliases": [],
  "details": "### Impact\nThe outdated version 1 of the Steam Socialite Provider doesn't check properly if the login comes from `steamcommunity.com`, allowing a malicious actor to substitute their own openID server.\n\n### Patches\nThis vulnerability only affects the outdated v1.x versions of the package. These are no longer maintained, users should upgrade to v3 or v4, which use a hardcoded endpoint to verify the login.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [SocialiteProviders/Providers](https://github.com/SocialiteProviders/Providers)\n* Email us at [[email protected]](mailto:[email protected])",
  "summary": "Steam Socialite Provider v1 does not correctly validate openid server",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0"
            }
          ]
        }
      ],
      "package": {
        "name": "socialiteproviders/steam",
        "ecosystem": "Packagist"
      },
      "database_specific": {
        "last_known_affected_version_range": "< 1.1"
      }
    }
  ],
  "modified": "2021-01-29T20:39:56Z",
  "severity": [],
  "published": "2021-01-29T20:51:30Z",
  "references": [
    {
      "url": "https://github.com/SocialiteProviders/Steam/security/advisories/GHSA-hhw9-35p2-q2c5",
      "type": "WEB"
    },
    {
      "url": "https://packagist.org/packages/socialiteproviders/steam",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-346"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2021-01-29T20:39:56Z"
  }
}