GHSA-9pr6-grf4-x2fr

Omniauth allows POST parameters to be stored in session

Source: GitHub Advisory Database (reviewed) High CVE-2017-18076

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	omniauth	< 1.3.2	1.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2017-18076 advisory
https://github.com/omniauth/omniauth/pull/867 web
https://github.com/omniauth/omniauth/pull/867/commits/71866c5264122e196847a3980c43051446a03e9b web
https://bugs.debian.org/888523 web
https://github.com/omniauth/omniauth package
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth/CVE-2017-18076.yml web
https://www.debian.org/security/2018/dsa-4109 web