Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1jN3ZmLW0zOTQtbTR4NM4AA5Wn

Use of Insufficiently Random Values in github.com/greenpau/caddy-security

Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure random number generation library which could possibly be predicted via a brute-force search. Attackers could use the potentially predictable nonce value used for authentication purposes in the OAuth flow to conduct OAuth replay attacks. In addition, insecure randomness is used while generating multifactor authentication (MFA) secrets and creating API keys in the database package.

Permalink: https://github.com/advisories/GHSA-c7vf-m394-m4x4
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jN3ZmLW0zOTQtbTR4NM4AA5Wn
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 3 months ago
Updated: 2 months ago

CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Identifiers: GHSA-c7vf-m394-m4x4, CVE-2024-21495
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-21495
• https://github.com/greenpau/caddy-security/issues/265
• https://github.com/greenpau/go-authcrunch/commit/ecd3725baf2683eb1519bb3c81ae41085fbf7dc2
• https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6248275
• https://github.com/advisories/GHSA-c7vf-m394-m4x4

Repository: https://github.com/greenpau/caddy-security
Blast Radius: 3.1

Affected Packages