doorkeeper 4.3.0
Doorkeeper gem does not revoke token for public clients
high severity CVE-2018-1000211>= 4.4.0, >= 5.0.0.rc2
< 4.2.0
Any OAuth application that uses public/non-confidential authentication when interacting with Doorkeeper is unable to revoke its tokens when calling the revocation endpoint.
A bug in the token revocation API would cause it to attempt to authenticate the public OAuth client as if it was a confidential app. Because of this, the token is never revoked.
The impact of this is the access or refresh token is not revoked, leaking access to protected resources for the remainder of that token's lifetime.
If Doorkeeper is used to facilitate public OAuth apps and leverage token revocation functionality, upgrade to the patched versions immediately.
Credit to Roberto Ostinelli for discovery, Justin Bull for the fixes.
DWF has assigned CVE-2018-1000211.
Doorkeeper Improper Authentication vulnerability
medium severity CVE-2023-34246>= 5.6.6
OAuth RFC 8252 says https://www.rfc-editor.org/rfc/rfc8252#section-8.6
the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. This includes the case where the user has previously approved an authorization request for a given client id
But Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured.
Issue https://github.com/doorkeeper-gem/doorkeeper/issues/1589
No officially reported memory leakage issues detected.
This gem version does not have any officially reported memory leaked issues.
No license issues detected.
This gem version has a license in the gemspec.
This gem version is available.
This gem version has not been yanked and is still available for usage.