Ruby/doorkeeper/0.7.0

Doorkeeper is an OAuth 2 provider for Rails and Grape.

https://rubygems.org/gems/doorkeeper
UNKNOWN

6 Security Vulnerabilities

Doorkeeper is vulnerable to replay attacks

Published date: 2017-10-24T18:33:35Z
CVE: CVE-2016-6582
Links:

The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.

Affected versions: ["4.1.0", "4.0.0", "4.0.0.rc4", "4.0.0.rc3", "4.0.0.rc2", "4.0.0.rc1", "3.1.0", "3.0.1", "3.0.0", "3.0.0.rc2", "3.0.0.rc1", "2.2.2", "2.2.1", "2.2.0", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.0.1", "2.0.0", "2.0.0.rc3", "2.0.0.rc2", "2.0.0.alpha1", "1.4.2", "1.4.1", "1.4.0", "1.3.1", "1.3.0", "1.2.0", "1.1.0", "1.0.0", "1.0.0.rc2", "1.0.0.rc1", "0.7.4", "0.7.3", "0.7.2", "0.7.1", "0.7.0", "0.6.7", "0.6.6", "0.6.5", "0.6.4", "0.6.3", "0.6.2", "0.6.1", "0.6.0", "0.6.0.rc1", "0.5.0", "0.5.0.rc1", "0.4.2", "0.4.1", "0.4.0", "0.3.4", "0.3.3", "0.3.2", "0.3.1", "0.3.0", "0.2.0", "0.1.1", "0.1.0"]
Secure versions: [5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.7.0, 5.7.1, 5.8.0]
Recommendation: Update to version 5.8.0.

Doorkeeper contains Cross-site Request Forgery

Published date: 2018-09-17T21:55:22Z
CVE: CVE-2014-8144
Links:

Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecified victims for requests that read a user OAuth authorization code via unknown vectors.

Affected versions: ["1.4.0", "1.3.1", "1.3.0", "1.2.0", "1.1.0", "1.0.0", "1.0.0.rc2", "1.0.0.rc1", "0.7.4", "0.7.3", "0.7.2", "0.7.1", "0.7.0", "0.6.7", "0.6.6", "0.6.5", "0.6.4", "0.6.3", "0.6.2", "0.6.1", "0.6.0", "0.6.0.rc1", "0.5.0", "0.5.0.rc1", "0.4.2", "0.4.1", "0.4.0", "0.3.4", "0.3.3", "0.3.2", "0.3.1", "0.3.0", "0.2.0", "0.1.1", "0.1.0"]
Secure versions: [5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.7.0, 5.7.1, 5.8.0]
Recommendation: Update to version 5.8.0.

Doorkeeper Improper Authentication vulnerability

Published date: 2023-06-12T19:50:34Z
CVE: CVE-2023-34246
Links:

OAuth RFC 8252 says https://www.rfc-editor.org/rfc/rfc8252#section-8.6

the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. This includes the case where the user has previously approved an authorization request for a given client id

But Doorkeeper automatically processes authorization requests without user consent for public clients that have been previously approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured.

Issue https://github.com/doorkeeper-gem/doorkeeper/issues/1589

Fix https://github.com/doorkeeper-gem/doorkeeper/pull/1646

Affected versions: ["5.5.0.rc1", "5.4.0", "5.4.0.rc2", "5.4.0.rc1", "5.3.3", "5.3.2", "5.3.1", "5.3.0", "5.2.6", "5.2.5", "5.2.4", "5.2.3", "5.2.2", "5.2.1", "5.2.0", "5.2.0.rc3", "5.2.0.rc2", "5.2.0.rc1", "5.1.2", "5.1.1", "5.1.0", "5.1.0.rc2", "5.1.0.rc1", "5.0.3", "5.0.2", "5.0.1", "5.0.0", "5.0.0.rc2", "5.0.0.rc1", "4.4.3", "4.4.2", "4.4.1", "4.4.0", "4.3.2", "4.3.1", "4.3.0", "4.2.6", "4.2.5", "4.2.0", "4.1.0", "4.0.0", "4.0.0.rc4", "4.0.0.rc3", "4.0.0.rc2", "4.0.0.rc1", "3.1.0", "3.0.1", "3.0.0", "3.0.0.rc2", "3.0.0.rc1", "2.2.2", "2.2.1", "2.2.0", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.0.1", "2.0.0", "2.0.0.rc3", "2.0.0.rc2", "2.0.0.alpha1", "1.4.2", "1.4.1", "1.4.0", "1.3.1", "1.3.0", "1.2.0", "1.1.0", "1.0.0", "1.0.0.rc2", "1.0.0.rc1", "0.7.4", "0.7.3", "0.7.2", "0.7.1", "0.7.0", "0.6.7", "0.6.6", "0.6.5", "0.6.4", "0.6.3", "0.6.2", "0.6.1", "0.6.0", "0.6.0.rc1", "0.5.0", "0.5.0.rc1", "0.4.2", "0.4.1", "0.4.0", "0.3.4", "0.3.3", "0.3.2", "0.3.1", "0.3.0", "0.2.0", "0.1.1", "0.1.0", "5.5.0.rc2", "5.5.0", "5.5.1", "5.5.2", "5.5.3", "5.5.4", "5.6.0.rc1", "5.6.0.rc2", "5.6.0", "5.6.1", "5.6.2", "5.6.3", "5.6.4", "5.6.5"]
Secure versions: [5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.7.0, 5.7.1, 5.8.0]
Recommendation: Update to version 5.8.0.

Cross-site request forgery (CSRF) vulnerability in doorkeeper 1.4.0 and earlier.

Published date: 2014-12-18
CVE: 2014-8144
CVSS V2: 6.8
Links:

Cross-site request forgery (CSRF) vulnerability in doorkeeper 1.4.0 and earlier allows remote attackers to hijack the user's OAuth autorization code. This vulnerability has been assigned the CVE identifier CVE-2014-8144.

Doorkeeper's endpoints didn't have CSRF protection. Any HTML document on the Internet can then read a user's authorization code with arbitrary scope from any Doorkeeper-compatible Rails app you are logged in.

Affected versions: ["2.0.0.rc3", "2.0.0.rc2", "2.0.0.alpha1", "1.3.1", "1.3.0", "1.2.0", "1.1.0", "1.0.0", "1.0.0.rc2", "1.0.0.rc1", "0.7.4", "0.7.3", "0.7.2", "0.7.1", "0.7.0", "0.6.7", "0.6.6", "0.6.5", "0.6.4", "0.6.3", "0.6.2", "0.6.1", "0.6.0", "0.6.0.rc1", "0.5.0", "0.5.0.rc1", "0.4.2", "0.4.1", "0.4.0", "0.3.4", "0.3.3", "0.3.2", "0.3.1", "0.3.0", "0.2.0", "0.1.1", "0.1.0"]
Secure versions: [5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.7.0, 5.7.1, 5.8.0]
Recommendation: Update to version 5.8.0.

Doorkeeper Improper Authentication vulnerability

Published date: 2023-06-12
CVE: 2023-34246
CVSS V3: 4.2
Links:

OAuth RFC 8252 says https://www.rfc-editor.org/rfc/rfc8252#section-8.6

the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. This includes the case where the user has previously approved an authorization request for a given client id

But Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured.

Issue https://github.com/doorkeeper-gem/doorkeeper/issues/1589

Fix https://github.com/doorkeeper-gem/doorkeeper/pull/1646

Affected versions: ["5.5.0.rc1", "5.4.0", "5.4.0.rc2", "5.4.0.rc1", "5.3.3", "5.3.2", "5.3.1", "5.3.0", "5.2.6", "5.2.5", "5.2.4", "5.2.3", "5.2.2", "5.2.1", "5.2.0", "5.2.0.rc3", "5.2.0.rc2", "5.2.0.rc1", "5.1.2", "5.1.1", "5.1.0", "5.1.0.rc2", "5.1.0.rc1", "5.0.3", "5.0.2", "5.0.1", "5.0.0", "5.0.0.rc2", "5.0.0.rc1", "4.4.3", "4.4.2", "4.4.1", "4.4.0", "4.3.2", "4.3.1", "4.3.0", "4.2.6", "4.2.5", "4.2.0", "4.1.0", "4.0.0", "4.0.0.rc4", "4.0.0.rc3", "4.0.0.rc2", "4.0.0.rc1", "3.1.0", "3.0.1", "3.0.0", "3.0.0.rc2", "3.0.0.rc1", "2.2.2", "2.2.1", "2.2.0", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.0.1", "2.0.0", "2.0.0.rc3", "2.0.0.rc2", "2.0.0.alpha1", "1.4.2", "1.4.1", "1.4.0", "1.3.1", "1.3.0", "1.2.0", "1.1.0", "1.0.0", "1.0.0.rc2", "1.0.0.rc1", "0.7.4", "0.7.3", "0.7.2", "0.7.1", "0.7.0", "0.6.7", "0.6.6", "0.6.5", "0.6.4", "0.6.3", "0.6.2", "0.6.1", "0.6.0", "0.6.0.rc1", "0.5.0", "0.5.0.rc1", "0.4.2", "0.4.1", "0.4.0", "0.3.4", "0.3.3", "0.3.2", "0.3.1", "0.3.0", "0.2.0", "0.1.1", "0.1.0", "5.5.0.rc2", "5.5.0", "5.5.1", "5.5.2", "5.5.3", "5.5.4", "5.6.0.rc1", "5.6.0.rc2", "5.6.0", "5.6.1", "5.6.2", "5.6.3", "5.6.4", "5.6.5"]
Secure versions: [5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.7.0, 5.7.1, 5.8.0]
Recommendation: Update to version 5.8.0.

Doorkeeper Gem for Ruby stores sensitive information in production logs

Published date: 2015-02-10
Links:

Doorkeeper Gem for Ruby contains a flaw in lib/doorkeeper/engine.rb. The issue is due to the program storing sensitive information in production logs. This may allow a local attacker to gain access to sensitive information.

Affected versions: ["2.1.1", "2.1.0", "2.0.1", "2.0.0", "2.0.0.rc3", "2.0.0.rc2", "2.0.0.alpha1", "1.3.1", "1.3.0", "1.2.0", "1.1.0", "1.0.0", "1.0.0.rc2", "1.0.0.rc1", "0.7.4", "0.7.3", "0.7.2", "0.7.1", "0.7.0", "0.6.7", "0.6.6", "0.6.5", "0.6.4", "0.6.3", "0.6.2", "0.6.1", "0.6.0", "0.6.0.rc1", "0.5.0", "0.5.0.rc1", "0.4.2", "0.4.1", "0.4.0", "0.3.4", "0.3.3", "0.3.2", "0.3.1", "0.3.0", "0.2.0", "0.1.1", "0.1.0"]
Secure versions: [5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.7.0, 5.7.1, 5.8.0]
Recommendation: Update to version 5.8.0.

121 Other Versions

Version License Security Released
5.8.0 MIT 2024-10-31 - 07:54 17 days
5.7.1 MIT 2024-06-25 - 14:54 5 months
5.7.0 MIT 2024-04-24 - 10:44 7 months
5.6.9 MIT 2024-02-14 - 07:54 9 months
5.6.8 MIT 2023-12-01 - 16:02 12 months
5.6.7 MIT 2023-11-23 - 07:56 12 months
5.6.6 MIT 2023-03-29 - 07:19 over 1 year
5.6.5 MIT 2 2023-02-22 - 09:00 over 1 year
5.6.4 MIT 2 2023-01-31 - 07:24 almost 2 years
5.6.3 MIT 2 2023-01-30 - 12:01 almost 2 years
5.6.2 MIT 2 2022-11-29 - 08:19 almost 2 years
5.6.1 MIT 2 2022-11-28 - 08:20 almost 2 years
5.6.0 MIT 2 2022-09-08 - 06:32 about 2 years
5.6.0.rc2 MIT 2 2022-05-26 - 07:43 over 2 years
5.6.0.rc1 MIT 2 2022-02-04 - 07:10 almost 3 years
5.5.4 MIT 2 2021-10-05 - 13:57 about 3 years
5.5.3 MIT 2 2021-09-23 - 07:09 about 3 years
5.5.2 MIT 2 2021-06-11 - 07:26 over 3 years
5.5.1 MIT 2 2021-04-06 - 15:52 over 3 years
5.5.0 MIT 2 2021-02-19 - 06:35 over 3 years
5.5.0.rc2 MIT 2 2021-01-21 - 17:31 almost 4 years
5.5.0.rc1 MIT 2 2020-08-04 - 07:18 over 4 years
5.4.0 MIT 2 2020-05-11 - 10:46 over 4 years
5.4.0.rc2 MIT 2 2020-05-02 - 13:27 over 4 years
5.4.0.rc1 MIT 2 2020-04-08 - 07:40 over 4 years
5.3.3 MIT 2 2020-05-07 - 19:17 over 4 years
5.3.2 MIT 2 2020-05-02 - 13:14 over 4 years
5.3.1 MIT 4 2020-02-09 - 09:42 almost 5 years
5.3.0 MIT 4 2020-01-29 - 14:54 almost 5 years
5.2.6 MIT 2 2020-05-07 - 19:20 over 4 years
5.2.5 MIT 2 2020-05-02 - 13:25 over 4 years
5.2.4 MIT 3 2020-02-09 - 09:49 almost 5 years
5.2.3 MIT 3 2019-12-12 - 14:46 almost 5 years
5.2.2 MIT 3 2019-11-10 - 10:17 about 5 years
5.2.1 MIT 3 2019-09-17 - 13:32 about 5 years
5.2.0 MIT 3 2019-09-16 - 08:31 about 5 years
5.2.0.rc3 MIT 2 2019-08-28 - 07:35 about 5 years
5.2.0.rc2 MIT 2 2019-06-17 - 08:27 over 5 years
5.2.0.rc1 MIT 2 2019-05-23 - 15:17 over 5 years
5.1.2 MIT 2 2020-10-19 - 07:54 about 4 years
5.1.1 MIT 2 2020-05-02 - 13:38 over 4 years
5.1.0 MIT 3 2019-04-17 - 14:35 over 5 years
5.1.0.rc2 MIT 2 2019-03-22 - 07:49 over 5 years
5.1.0.rc1 MIT 2 2019-01-17 - 08:41 almost 6 years
5.0.3 MIT 2 2020-05-05 - 08:43 over 4 years
5.0.2 MIT 3 2018-10-25 - 09:25 about 6 years
5.0.1 MIT 3 2018-10-10 - 14:08 about 6 years
5.0.0 MIT 3 2018-08-24 - 13:55 about 6 years
5.0.0.rc2 MIT 2 2018-07-17 - 10:01 over 6 years
5.0.0.rc1 MIT 2 2018-06-11 - 11:42 over 6 years
4.4.3 MIT 2 2018-09-19 - 08:41 about 6 years
4.4.2 MIT 2 2018-08-20 - 15:24 about 6 years
4.4.1 MIT 2 2018-07-27 - 14:58 over 6 years
4.4.0 MIT 2 2018-07-17 - 09:57 over 6 years
4.3.2 MIT 4 2018-03-28 - 09:49 over 6 years
4.3.1 MIT 4 2018-03-03 - 09:44 over 6 years
4.3.0 MIT 4 2018-02-23 - 15:06 over 6 years
4.2.6 MIT 4 2017-05-26 - 00:08 over 7 years
4.2.5 MIT 6 2017-02-12 - 16:09 almost 8 years
4.2.0 MIT 6 2016-08-18 - 21:15 about 8 years
4.1.0 MIT 7 2016-07-29 - 23:09 over 8 years
4.0.0 MIT 7 2016-07-01 - 21:31 over 8 years
4.0.0.rc4 MIT 7 2016-05-17 - 18:14 over 8 years
4.0.0.rc3 MIT 7 2016-04-20 - 22:23 over 8 years
4.0.0.rc2 MIT 7 2016-03-03 - 01:56 over 8 years
4.0.0.rc1 MIT 7 2016-02-26 - 03:36 over 8 years
3.1.0 MIT 7 2015-12-23 - 18:14 almost 9 years
3.0.1 MIT 7 2015-09-24 - 03:49 about 9 years
3.0.0 MIT 7 2015-07-30 - 19:09 over 9 years
3.0.0.rc2 MIT 7 2015-07-09 - 22:32 over 9 years
3.0.0.rc1 MIT 7 2015-05-12 - 03:18 over 9 years
2.2.2 MIT 7 2015-07-30 - 19:15 over 9 years
2.2.1 MIT 7 2015-05-05 - 02:12 over 9 years
2.2.0 MIT 7 2015-04-19 - 12:54 over 9 years
2.1.4 MIT 7 2015-03-27 - 16:14 over 9 years
2.1.3 MIT 7 2015-03-01 - 22:34 over 9 years
2.1.2 MIT 7 2015-02-26 - 02:39 over 9 years
2.1.1 MIT 8 2015-02-06 - 16:12 almost 10 years
2.1.0 MIT 8 2015-01-13 - 20:40 almost 10 years
2.0.1 MIT 6 2014-12-17 - 19:44 almost 10 years
2.0.0 MIT 6 2014-12-16 - 21:03 almost 10 years
2.0.0.rc3 MIT 7 2014-12-14 - 16:59 almost 10 years
2.0.0.rc2 MIT 7 2014-12-09 - 13:18 almost 10 years
2.0.0.alpha1 MIT 7 2014-10-11 - 21:04 about 10 years
1.4.2 MIT 5 2015-03-03 - 04:09 over 9 years
1.4.1 MIT 5 2014-12-17 - 13:13 almost 10 years
1.4.0 MIT 6 2014-07-31 - 15:49 over 10 years
1.3.1 MIT 8 2014-07-06 - 14:50 over 10 years
1.3.0 MIT 8 2014-05-23 - 15:19 over 10 years
1.2.0 MIT 8 2014-05-03 - 13:31 over 10 years
1.1.0 MIT 6 2014-03-29 - 17:43 over 10 years
1.0.0 MIT 6 2014-01-13 - 17:53 almost 11 years
1.0.0.rc2 MIT 6 2014-01-09 - 20:02 almost 11 years
1.0.0.rc1 MIT 6 2013-12-11 - 19:02 almost 11 years
0.7.4 MIT 6 2013-12-01 - 18:57 almost 11 years
0.7.3 MIT 6 2013-10-04 - 22:58 about 11 years
0.7.2 MIT 6 2013-09-11 - 00:43 about 11 years
0.7.1 MIT 6 2013-08-30 - 21:34 about 11 years
0.7.0 UNKNOWN 6 2013-08-22 - 03:04 about 11 years
0.6.7 UNKNOWN 6 2013-01-13 - 18:48 almost 12 years