PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Oauth_client_library_for_java | * | 1.31.0 (excluding) | |
OCP-Tools-4.12-RHEL-8 | RedHat | jenkins-2-plugins-0:4.12.1698294000-1.el8 | * |
OCP-Tools-4.12-RHEL-8 | RedHat | jenkins-2-plugins-0:4.12.1706515741-1.el8 | * |
OCP-Tools-4.13-RHEL-8 | RedHat | jenkins-2-plugins-0:4.13.1684911916-1.el8 | * |
Red Hat OpenShift Container Platform 4.10 | RedHat | jenkins-2-plugins-0:4.10.1675144701-1.el8 | * |
Red Hat OpenShift Container Platform 4.9 | RedHat | jenkins-2-plugins-0:4.9.1675668922-1.el8 | * |
Google-oauth-client-java | Ubuntu | groovy | * |
Google-oauth-client-java | Ubuntu | hirsute | * |
Google-oauth-client-java | Ubuntu | impish | * |
Google-oauth-client-java | Ubuntu | kinetic | * |
Google-oauth-client-java | Ubuntu | lunar | * |
Google-oauth-client-java | Ubuntu | mantic | * |
Google-oauth-client-java | Ubuntu | trusty | * |
Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user’s privileges and any permissions or other access-control specifications that apply to the resource. When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.