USN-6210-1: Doorkeeper vulnerability

Releases

• Ubuntu 23.04
• Ubuntu 22.10
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM
• Ubuntu 16.04 ESM

Packages

• ruby-doorkeeper - OAuth 2 provider for Rails and Grape

Details

It was discovered that Doorkeeper incorrectly performed authorization checks
for public clients that have been previous approved. An attacker could
potentially exploit these in order to impersonate another user and obtain
sensitive information.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.04

• ruby-doorkeeper - 5.5.0-2ubuntu0.23.04.1

Ubuntu 22.10

• ruby-doorkeeper - 5.5.0-2ubuntu0.22.10.1

Ubuntu 22.04

• ruby-doorkeeper - 5.5.0-2ubuntu0.22.04.1

Ubuntu 20.04

• ruby-doorkeeper - 5.0.2-2ubuntu0.1

Ubuntu 18.04

• ruby-doorkeeper - 4.3.1-1ubuntu0.1~esm1
  Available with Ubuntu Pro

Ubuntu 16.04

• ruby-doorkeeper - 2.2.1-1ubuntu0.1~esm1
  Available with Ubuntu Pro

After a standard system update you need to restart any applications using
Doorkeeper to make all the necessary changes.

References

• CVE-2023-34246