Search for packages
| purl | pkg:maven/org.wildfly.security/wildfly-elytron-http-oidc@2.2.2.Final |
| Next non-vulnerable version | 2.2.9.Final |
| Latest non-vulnerable version | 2.6.2.Final |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-etqf-v4yp-4fdu
Aliases: CVE-2023-6236 GHSA-jpmx-996v-48fm |
WildFly Elytron: OIDC app attempting to access the second tenant, the user should be prompted to log A flaw was found in JBoss EAP. When an OIDC app that serves multiple tenants attempts to access the second tenant, it should prompt the user to log in again since the second tenant is secured with a different OIDC configuration. The underlying issue is in OidcSessionTokenStore when determining if a cached token should be used or not. This logic needs to be updated to take into account the new "provider-url" option in addition to the "realm" option. |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. |
|
VCID-rkxb-8u8q-1ua4
Aliases: CVE-2024-12369 GHSA-5565-3c98-g6jc |
WildFly Elytron OpenID Connect Client ExtensionOIDC authorization code injection attack ### Impact A vulnerability was found in OIDC-Client. When using the elytron-oidc-client subsystem with WildFly, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack. ### Patches [2.2.9.Final](https://github.com/wildfly-security/wildfly-elytron/releases/tag/2.2.9.Final) [2.6.2.Final](https://github.com/wildfly-security/wildfly-elytron/releases/tag/2.6.2.Final) ### Workarounds Currently, no mitigation is currently available for this vulnerability. ### References https://nvd.nist.gov/vuln/detail/CVE-2024-12369 https://access.redhat.com/security/cve/CVE-2024-12369 https://bugzilla.redhat.com/show_bug.cgi?id=2331178 https://issues.redhat.com/browse/ELY-2887 |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||