| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/zitadel/zitadel | ≥ 2.43.0, < 2.43.11≥ 2.44.0, < 2.44.7≥ 2.45.0, < 2.45.5≥ 2.46.0, < 2.46.5≥ 2.47.0, < 2.47.8≥ 2.48.0, < 2.48.3< 2.42.17all versions | 2.43.112.44.72.45.52.46.52.47.82.48.32.42.17 |
| zitadel | ≥ 2.43.0, < 2.43.11≥ 2.44.0, < 2.44.7≥ 2.45.0, < 2.45.5≥ 2.46.0, < 2.46.5≥ 2.47.0, < 2.47.8≥ 2.48.0, < 2.48.3< 2.42.17 | 2.43.112.44.72.45.52.46.52.47.82.48.32.42.17 |
Under certain circumstances an action could set reserved claims managed by ZITADEL.
For example it would be possible to set the claim urn:zitadel:iam:user:resourceowner:name
{"urn:zitadel:iam:user:resourceowner:name": "ACME"}
if it was not set by ZITADEL itself.
To compensate for this we introduced a protection that does prevent actions from changing claims that start with urn:zitadel:iam
2.x versions are fixed on >= 2.48.3 2.47.x versions are fixed on >= 2.47.8 2.46.x versions are fixed on >= 2.46.5 2.45.x versions are fixed on >= 2.45.5 2.44.x versions are fixed on >= 2.44.7 2.43.x versions are fixed on >= 2.43.11 2.42.x versions are fixed on >= 2.42.17
No workaround available since a patch is available
Many thanks to @schettn whose disclosure of another topic lead us to find this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free