Ubuntu 6210-1 Critical: Doorkeeper Trendy Data Exposure Threat

ubuntu

July 7, 2023

Doorkeeper could be made to expose sensitive information over the network.

Summary

Doorkeeper could be made to expose sensitive information over the

network.

Software Description:

- ruby-doorkeeper: OAuth 2 provider for Rails and Grape

Details:

It was discovered that Doorkeeper incorrectly performed authorization checks

for public clients that have been previous approved. An attacker could

potentially exploit these in order to impersonate another user and obtain

sensitive information.

Topics Covered

security advisory critical ubuntu data exposure authorization issue doorkeeper

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
  ruby-doorkeeper                 5.5.0-2ubuntu0.23.04.1

Ubuntu 22.10:
  ruby-doorkeeper                 5.5.0-2ubuntu0.22.10.1

Ubuntu 22.04 LTS:
  ruby-doorkeeper                 5.5.0-2ubuntu0.22.04.1

Ubuntu 20.04 LTS:
  ruby-doorkeeper                 5.0.2-2ubuntu0.1

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
  ruby-doorkeeper                 4.3.1-1ubuntu0.1~esm1

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
  ruby-doorkeeper                 2.2.1-1ubuntu0.1~esm1

After a standard system update you need to restart any applications using
Doorkeeper to make all the necessary changes.