Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1ncDhnLWY0MmYtOTVxMs4AA6ar
ZITADEL's actions can overload reserved claims
Impact
Under certain circumstances an action could set reserved claims managed by ZITADEL.
For example it would be possible to set the claim urn:zitadel:iam:user:resourceowner:name
{"urn:zitadel:iam:user:resourceowner:name": "ACME"}
if it was not set by ZITADEL itself.
To compensate for this we introduced a protection that does prevent actions from changing claims that start with urn:zitadel:iam
Patches
2.x versions are fixed on >= 2.48.3
2.47.x versions are fixed on >= 2.47.8
2.46.x versions are fixed on >= 2.46.5
2.45.x versions are fixed on >= 2.45.5
2.44.x versions are fixed on >= 2.44.7
2.43.x versions are fixed on >= 2.43.11
2.42.x versions are fixed on >= 2.42.17
Workarounds
No workaround available since a patch is available
Credits
Many thanks to @schettn whose disclosure of another topic lead us to find this issue.
Permalink: https://github.com/advisories/GHSA-gp8g-f42f-95q2JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ncDhnLWY0MmYtOTVxMs4AA6ar
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 month ago
Updated: about 1 month ago
CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Identifiers: GHSA-gp8g-f42f-95q2, CVE-2024-29892
References:
- https://github.com/zitadel/zitadel/security/advisories/GHSA-gp8g-f42f-95q2
- https://nvd.nist.gov/vuln/detail/CVE-2024-29892
- https://github.com/zitadel/zitadel/releases/tag/v2.42.17
- https://github.com/zitadel/zitadel/releases/tag/v2.43.11
- https://github.com/zitadel/zitadel/releases/tag/v2.44.7
- https://github.com/zitadel/zitadel/releases/tag/v2.45.5
- https://github.com/zitadel/zitadel/releases/tag/v2.46.5
- https://github.com/zitadel/zitadel/releases/tag/v2.47.8
- https://github.com/zitadel/zitadel/releases/tag/v2.48.3
- https://github.com/advisories/GHSA-gp8g-f42f-95q2
Blast Radius: 1.0
Affected Packages
go:github.com/zitadel/zitadel
Dependent packages: 0Dependent repositories: 0
Downloads:
Affected Version Ranges: >= 2.48.0, < 2.48.3, >= 2.47.0, < 2.47.8, >= 2.46.0, < 2.46.5, >= 2.45.0, < 2.45.5, >= 2.44.0, < 2.44.7, >= 2.43.0, < 2.43.11, < 2.42.17
Fixed in: 2.48.3, 2.47.8, 2.46.5, 2.45.5, 2.44.7, 2.43.11, 2.42.17
All affected versions: 0.0.0, 0.1.0, 0.2.0, 0.3.0, 0.3.1, 0.4.0, 0.4.1, 0.5.0, 0.6.0, 0.7.0, 0.8.0, 0.9.0, 0.10.0, 0.11.0, 0.12.0, 0.13.0, 0.14.0, 0.15.0, 0.16.0, 0.17.0, 0.17.1, 0.18.0, 0.18.1, 0.18.2, 0.18.3, 0.19.0, 0.20.0, 0.20.1, 0.20.2, 0.21.0, 0.22.0, 0.22.1, 0.22.2, 0.22.3, 0.22.4, 0.22.5, 0.22.6, 0.22.7, 0.23.0, 0.23.1, 0.24.0, 0.24.1, 0.24.2, 0.24.3, 0.25.0, 0.25.1, 0.26.0, 0.27.0, 0.28.0, 0.29.0, 0.29.1, 0.30.0, 0.30.1, 0.31.0, 0.31.1, 0.31.2, 0.31.3, 0.32.0, 0.32.1, 0.32.2, 0.33.0, 0.33.1, 0.33.2, 0.33.3, 0.33.4, 0.33.5, 0.34.0, 0.35.0, 0.35.1, 0.35.2, 0.36.0, 0.37.0, 0.38.0, 0.39.0, 0.39.1, 0.40.0, 0.40.1, 0.40.2, 0.40.3, 0.40.4, 0.41.0, 0.41.1, 0.42.0, 0.42.1, 0.42.2, 0.42.3, 0.42.4, 0.43.0, 0.43.1, 0.43.2, 0.44.0, 0.44.1, 0.44.2, 0.44.3, 0.45.0, 0.46.0, 0.46.1, 0.47.0, 0.47.1, 0.47.2, 0.47.3, 0.47.4, 0.47.5, 0.48.0, 0.49.0, 0.49.1, 0.50.0, 0.51.0, 0.51.1, 0.52.0, 0.53.0, 0.53.1, 0.53.2, 0.53.3, 0.53.4, 0.53.5, 0.54.0, 0.54.1, 0.54.2, 0.54.3, 0.54.4, 0.54.5, 0.55.0, 0.55.1, 0.55.2, 0.55.3, 0.55.4, 0.55.5, 0.55.6, 0.55.7, 0.55.8, 0.55.9, 0.55.10, 0.55.11, 0.55.12, 0.55.13, 0.56.0, 0.56.1, 0.57.0, 0.57.1, 0.57.2, 0.58.0, 0.59.0, 0.59.1, 0.60.0, 0.60.1, 0.61.0, 0.61.1, 0.61.2, 0.61.3, 0.61.4, 0.62.0, 0.63.0, 0.63.1, 0.64.0, 0.64.1, 0.64.2, 0.64.3, 0.64.4, 0.64.5, 0.64.6, 0.64.7, 0.65.0, 0.66.0, 0.66.1, 0.67.0, 0.67.1, 0.67.2, 0.68.0, 0.69.0, 0.69.1, 0.70.0, 0.70.1, 0.71.0, 0.72.0, 0.73.0, 0.74.0, 0.74.1, 0.74.2, 0.74.3, 0.74.4, 0.75.0, 0.75.1, 0.75.2, 0.75.3, 0.75.4, 0.75.5, 0.76.0, 0.76.1, 0.76.2, 0.76.3, 0.77.0, 0.77.1, 0.77.2, 0.77.3, 0.77.4, 0.77.5, 0.78.0, 0.78.1, 0.78.2, 0.79.0, 0.80.0, 0.80.1, 0.80.2, 0.81.0, 0.81.1, 0.81.2, 0.81.3, 0.81.4, 0.81.5, 0.81.6, 0.82.0, 0.82.1, 0.82.2, 0.82.3, 0.82.4, 0.83.0, 0.83.1, 0.83.2, 0.83.3, 0.83.4, 0.83.5, 0.83.6, 0.84.0, 0.84.1, 0.84.2, 0.84.3, 0.84.4, 0.85.0, 0.85.1, 0.85.2, 0.85.3, 0.85.4, 0.86.0, 0.86.1, 0.86.2, 0.87.0, 0.87.1, 0.88.0, 0.88.1, 0.88.2, 0.88.3, 0.88.4, 0.88.5, 0.88.6, 0.88.7, 0.88.8, 0.89.0, 0.89.1, 0.89.2, 0.89.3, 0.89.4, 0.90.0, 0.90.1, 0.90.2, 0.91.0, 0.91.1, 0.91.2, 0.91.3, 0.91.4, 0.91.5, 0.91.6, 0.92.0, 0.93.0, 0.93.1, 0.94.0, 0.94.1, 0.95.0, 0.95.1, 0.95.2, 0.95.3, 0.95.4, 0.95.5, 0.95.6, 0.95.7, 0.95.8, 0.95.9, 0.95.10, 0.96.0, 0.97.0, 0.97.1, 0.97.2, 0.98.0, 0.99.0, 0.99.1, 0.100.0, 0.100.1, 0.100.2, 0.100.3, 0.100.4, 0.101.0, 0.102.0, 0.102.1, 0.103.0, 0.103.1, 0.103.2, 0.104.0, 0.104.1, 0.104.2, 0.104.3, 0.104.4, 0.104.5, 0.104.6, 0.104.7, 0.104.8, 0.104.9, 0.104.10, 0.104.11, 0.105.0, 0.105.1, 0.105.2, 0.105.3, 0.105.4, 0.105.5, 0.105.6, 0.105.7, 0.105.8, 0.106.0, 0.106.1, 0.106.2, 0.106.3, 0.107.0, 0.108.0, 0.108.1, 0.108.2, 0.108.3, 0.108.4, 0.109.0, 0.109.1, 0.109.2, 0.109.3, 0.109.4, 0.109.5, 0.109.6, 0.109.7, 0.109.8, 0.109.9, 0.109.10, 0.109.11, 0.109.12, 0.109.13, 0.109.14, 0.109.15, 0.109.16, 0.109.17, 0.109.18, 0.109.19, 0.110.0, 0.110.1, 0.110.2, 0.111.0, 0.111.1, 0.111.2, 0.111.3, 0.112.0, 0.112.1, 0.112.2, 0.112.3, 0.112.4, 0.112.5, 0.112.6, 0.112.7, 0.112.8, 0.112.9, 0.113.0, 0.113.1, 0.114.0, 0.114.1, 0.114.2, 0.115.0, 0.115.1, 0.115.2, 0.115.3, 0.116.0, 0.116.1, 0.116.2, 0.116.3, 0.116.4, 0.116.5, 0.116.6, 0.116.7, 0.116.8, 0.116.9, 0.116.10, 0.117.0, 0.117.1, 0.117.2, 0.118.0, 0.118.1, 0.118.2, 0.118.3, 0.118.4, 0.118.5, 0.118.6, 0.119.0, 0.119.1, 0.119.2, 0.119.3, 0.119.4, 0.119.5, 0.119.6, 0.120.0, 0.120.1, 0.121.0, 0.121.1, 0.121.2, 0.122.0, 0.122.1, 0.122.2, 0.122.3, 0.122.4, 0.122.5, 0.123.0, 0.123.1, 0.123.2, 0.123.3, 0.123.4, 0.123.5, 0.124.0, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.1.0, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7, 1.3.0, 1.4.0, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.6.5, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.8.4, 1.9.0, 1.9.1, 1.9.2, 1.10.0, 1.10.1, 1.10.2, 1.10.3, 1.10.4, 1.10.5, 1.11.0, 1.11.1, 1.12.0, 1.12.1, 1.12.2, 1.12.3, 1.12.4, 1.12.5, 1.12.6, 1.12.7, 1.13.0, 1.14.0, 1.14.1, 1.15.0, 1.15.1, 1.16.0, 1.16.1, 1.16.2, 1.16.3, 1.16.4, 1.16.5, 1.16.6, 1.16.7, 1.16.8, 1.17.0, 1.17.1, 1.17.2, 1.17.3, 1.17.4, 1.17.5, 1.17.6, 1.17.7, 1.17.8, 1.17.9, 1.17.10, 1.18.0, 1.18.1, 1.19.0, 1.19.1, 1.19.2, 1.19.3, 1.19.4, 1.20.0, 1.20.1, 1.20.2, 1.20.3, 1.20.4, 1.20.5, 1.21.0, 1.21.1, 1.21.2, 1.21.3, 1.21.4, 1.22.0, 1.22.1, 1.22.2, 1.22.3, 1.22.4, 1.22.5, 1.22.6, 1.22.7, 1.22.8, 1.22.9, 1.22.10, 1.22.11, 1.22.12, 1.22.13, 1.23.0, 1.23.1, 1.23.2, 1.23.3, 1.23.4, 1.23.5, 1.24.0, 1.24.1, 1.24.2, 1.25.0, 1.25.1, 1.26.0, 1.26.1, 1.27.0, 1.27.1, 1.27.2, 1.27.3, 1.27.4, 1.28.0, 1.28.1, 1.28.2, 1.28.3, 1.28.4, 1.29.0, 1.29.1, 1.29.2, 1.29.3, 1.29.4, 1.29.5, 1.29.6, 1.30.0, 1.30.1, 1.30.2, 1.30.3, 1.30.4, 1.31.0, 1.31.1, 1.32.0, 1.32.1, 1.32.2, 1.32.3, 1.32.4, 1.32.5, 1.33.0, 1.33.1, 1.34.0, 1.34.1, 1.34.2, 1.34.3, 1.34.4, 1.34.5, 1.34.6, 1.34.7, 1.34.8, 1.34.9, 1.34.10, 1.34.11, 1.35.0, 1.35.1, 1.36.0, 1.37.0, 1.38.0, 1.39.0, 1.39.1, 1.40.0, 1.41.0, 1.41.1, 1.41.2, 1.41.3, 1.41.4, 1.42.0, 1.42.1, 1.42.2, 1.43.0, 1.43.1, 1.43.2, 1.43.3, 1.43.4, 1.44.0, 1.44.1, 1.44.2, 1.44.3, 1.44.4, 1.44.5, 1.45.0, 1.45.1, 1.45.2, 1.45.3, 1.45.4, 1.45.5, 1.45.6, 1.46.0, 1.46.1, 1.46.2, 1.46.3, 1.46.4, 1.47.0, 1.47.1, 1.47.2, 1.47.3, 1.47.4, 1.47.5, 1.47.6, 1.48.0, 1.48.1, 1.48.2, 1.48.3, 1.48.4, 1.48.5, 1.48.6, 1.48.7, 1.48.8, 1.49.0, 1.49.1, 1.50.0, 1.50.1, 1.50.2, 1.50.3, 1.50.4, 1.51.0, 1.52.0, 1.52.1, 1.52.2, 1.53.0, 1.53.1, 1.53.2, 1.54.0, 1.54.1, 1.54.2, 1.54.3, 1.54.4, 1.54.5, 1.54.6, 1.54.7, 1.54.8, 1.54.9, 1.54.10, 1.55.0, 1.55.1, 1.55.2, 1.56.0, 1.56.1, 1.56.2, 1.56.3, 1.56.4, 1.56.5, 1.56.6, 1.56.7, 1.56.8, 1.56.9, 1.56.10, 1.56.11, 1.56.12, 1.56.13, 1.56.14, 1.56.15, 1.56.16, 1.56.17, 1.56.18, 1.56.19, 1.56.20, 1.56.21, 1.56.22, 1.56.23, 1.56.24, 1.56.25, 1.56.26, 1.56.27, 1.56.28, 1.57.0, 1.57.1, 1.58.0, 1.59.0, 1.59.1, 1.59.2, 1.59.3, 1.60.0, 1.60.1, 1.60.2, 1.60.3, 1.61.0, 1.62.0, 1.62.1, 1.62.2, 1.63.0, 1.64.0, 1.65.0, 1.66.0, 1.66.1, 1.66.2, 1.66.3, 1.66.4, 1.66.5, 1.66.6, 1.66.7, 1.66.8, 1.66.9, 1.67.0, 1.67.1, 1.68.0, 1.68.1, 1.69.0, 1.69.1, 1.69.2, 1.69.3, 1.69.4, 1.69.5, 1.69.6, 1.69.7, 1.69.8, 1.69.9, 1.70.0, 1.70.1, 1.70.2, 1.71.0, 1.71.1, 1.71.2, 1.72.0, 1.72.1, 1.73.0, 1.73.1, 1.73.2, 1.73.3, 1.73.4, 1.73.5, 1.73.6, 1.73.7, 1.73.8, 1.73.9, 1.73.10, 1.74.0, 1.75.0, 1.75.1, 1.75.2, 1.75.3, 1.75.4, 1.75.5, 1.75.6, 1.75.7, 1.75.8, 1.76.0, 1.76.1, 1.76.2, 1.77.0, 1.77.1, 1.77.2, 1.78.0, 1.79.0, 1.80.0, 1.80.1, 1.80.2, 1.81.0, 1.81.1, 1.82.0, 1.82.1, 1.82.2, 1.82.3, 1.82.4, 1.82.5, 1.82.6, 1.82.7, 1.82.8, 1.82.9, 1.82.10, 1.82.11, 1.82.12, 1.82.13, 1.82.14, 1.82.15, 1.82.16, 1.82.17, 1.83.0, 1.83.1, 1.83.2, 1.83.3, 1.83.4, 1.83.5, 1.83.6, 1.83.7, 1.84.0, 1.84.1, 1.84.2, 1.84.3, 1.84.4, 1.84.5, 1.85.0, 1.86.0, 1.87.0, 1.87.1, 1.87.2, 1.87.3, 1.87.4, 1.87.5
All unaffected versions: