CVE-2020-15222
Description
In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authentication the uniqueness of the `jti` value is not checked. When using client authentication method "private_key_jwt", OpenId specification says the following about assertion `jti`: "A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties". Hydra does not seem to check the uniqueness of this `jti` value. This problem is fixed in version 0.31.0.
How to fix
- ory fosite0.31.0 or later
- github.com/ory/fosite0.31.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ory fosite | v < 0.31.0 | 0.31.0 |
| github.com/ory/fositeGo | v < 0.31.0 | 0.31.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.