{"containers": {"cna": {"affected": [{"product": "hydra", "vendor": "ory", "versions": [{"status": "affected", "version": "< 1.4.0+oryOS.17"}]}], "descriptions": [{"lang": "en", "value": "In Hydra (an OAuth2 Server and OpenID Certified\u2122 OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method 'private_key_jwt' [1], OpenId specification says the following about assertion `jti`: \"A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties\". Hydra does not check the uniqueness of this `jti` value. Exploiting this vulnerability is somewhat difficult because: - TLS protects against MITM which makes it difficult to intercept valid tokens for replay attacks - The expiry time of the JWT gives only a short window of opportunity where it could be replayed This has been patched in version v1.4.0+oryOS.17"}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-294", "description": "CWE-294: Authentication Bypass by Capture-replay", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-04-06T16:30:14", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ory/hydra/security/advisories/GHSA-3p3g-vpw6-4w66"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/ory/hydra/commit/700d17d3b7d507de1b1d459a7261d6fb2571ebe3"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/ory/hydra/releases/tag/v1.4.0"}], "source": {"advisory": "GHSA-3p3g-vpw6-4w66", "discovery": "UNKNOWN"}, "title": "Disallow replay of `private_key_jwt` by blacklisting JTIs in Hydra", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2020-5300", "STATE": "PUBLIC", "TITLE": "Disallow replay of `private_key_jwt` by blacklisting JTIs in Hydra"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "hydra", "version": {"version_data": [{"version_value": "< 1.4.0+oryOS.17"}]}}]}, "vendor_name": "ory"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In Hydra (an OAuth2 Server and OpenID Certified\u2122 OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method 'private_key_jwt' [1], OpenId specification says the following about assertion `jti`: \"A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties\". Hydra does not check the uniqueness of this `jti` value. Exploiting this vulnerability is somewhat difficult because: - TLS protects against MITM which makes it difficult to intercept valid tokens for replay attacks - The expiry time of the JWT gives only a short window of opportunity where it could be replayed This has been patched in version v1.4.0+oryOS.17"}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-294: Authentication Bypass by Capture-replay"}]}]}, "references": {"reference_data": [{"name": "https://github.com/ory/hydra/security/advisories/GHSA-3p3g-vpw6-4w66", "refsource": "CONFIRM", "url": "https://github.com/ory/hydra/security/advisories/GHSA-3p3g-vpw6-4w66"}, {"name": "https://github.com/ory/hydra/commit/700d17d3b7d507de1b1d459a7261d6fb2571ebe3", "refsource": "MISC", "url": "https://github.com/ory/hydra/commit/700d17d3b7d507de1b1d459a7261d6fb2571ebe3"}, {"name": "https://github.com/ory/hydra/releases/tag/v1.4.0", "refsource": "MISC", "url": "https://github.com/ory/hydra/releases/tag/v1.4.0"}]}, "source": {"advisory": "GHSA-3p3g-vpw6-4w66", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T08:22:09.093Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/ory/hydra/security/advisories/GHSA-3p3g-vpw6-4w66"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/ory/hydra/commit/700d17d3b7d507de1b1d459a7261d6fb2571ebe3"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/ory/hydra/releases/tag/v1.4.0"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2020-5300", "datePublished": "2020-04-06T16:30:14", "dateReserved": "2020-01-02T00:00:00", "dateUpdated": "2024-08-04T08:22:09.093Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ory:hydra:*:*:*:*:*:*:*:*", "matchCriteriaId": "DC62652F-A912-4B11-BACD-59690369C4E5", "versionEndExcluding": "1.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Hydra (an OAuth2 Server and OpenID Certified\u2122 OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method 'private_key_jwt' [1], OpenId specification says the following about assertion `jti`: \"A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties\". Hydra does not check the uniqueness of this `jti` value. Exploiting this vulnerability is somewhat difficult because: - TLS protects against MITM which makes it difficult to intercept valid tokens for replay attacks - The expiry time of the JWT gives only a short window of opportunity where it could be replayed This has been patched in version v1.4.0+oryOS.17"}, {"lang": "es", "value": "En Hydra (un OAuth2 Server y OpenID Certified\u2122 OpenID Connect Provider escrito en Go), versiones anteriores a 1.4.0+oryOS.17, cuando se usa el m\u00e9todo de autenticaci\u00f3n del cliente `private_key_jwt` [1], la especificaci\u00f3n OpenId dice lo siguiente sobre la afirmaci\u00f3n `jti`: \"Un identificador \u00fanico para el token, que puede ser usado para impedir la reutilizaci\u00f3n del token. Estos tokens DEBEN solo ser usados una vez, a menos que las condiciones de reutilizaci\u00f3n sean negociadas entre las partes\". Hydra no comprueba la exclusividad de este valor de 'jti'. Una explotaci\u00f3n de esta vulnerabilidad es algo dif\u00edcil porque: - TLS protege contra ataques de tipo MITM, lo que hace que sea dif\u00edcil interceptar tokens v\u00e1lidos para ataques de repetici\u00f3n - El tiempo de expiraci\u00f3n del JWT ofrece solo una peque\u00f1a ventana oportunidad para que pueda reproducirse Esto ha sido parcheado en la versi\u00f3n v1 .4.0+oryOS.17"}], "id": "CVE-2020-5300", "lastModified": "2020-04-07T13:52:35.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2020-04-06T17:15:13.367", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/ory/hydra/commit/700d17d3b7d507de1b1d459a7261d6fb2571ebe3"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/ory/hydra/releases/tag/v1.4.0"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/ory/hydra/security/advisories/GHSA-3p3g-vpw6-4w66"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-294"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-294"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}