~ / search / GHSA-8259-2x72-2gvc

GHSA-8259-2x72-2gvc

Eclipse Dataspace Components's ConsumerPullTransferTokenValidationApiController doesn't check for token validit

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-8642

Packages

EcosystemPackageAffectedFixed in
Maven org.eclipse.edc:transfer-data-plane >= 0.5.0, < 0.9.0 0.9.0

Details

As written in the advisory (Markdown source, shown as plain text).

In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity (expiry, not-before, issuance date), which can allow an attacker to bypass the check for token expiration. The issue requires to have a dataplane configured to support http proxy consumer pull AND include the module "transfer-data-plane". The affected code was marked deprecated from the version 0.6.0 in favour of Dataplane Signaling. In 0.9.0 the vulnerable code has been removed.

References

External links from the advisory. They lead to third-party sites.