| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| github.com/zitadel/zitadel | ≥ 2.43.0, < 2.43.11≥ 2.44.0, < 2.44.7≥ 2.45.0, < 2.45.5≥ 2.46.0, < 2.46.5≥ 2.47.0, < 2.47.8≥ 2.48.0, < 2.48.3< 2.42.17mọi phiên bản | 2.43.112.44.72.45.52.46.52.47.82.48.32.42.17 |
| zitadel | ≥ 2.43.0, < 2.43.11≥ 2.44.0, < 2.44.7≥ 2.45.0, < 2.45.5≥ 2.46.0, < 2.46.5≥ 2.47.0, < 2.47.8≥ 2.48.0, < 2.48.3< 2.42.17 | 2.43.112.44.72.45.52.46.52.47.82.48.32.42.17 |
Under certain circumstances an action could set reserved claims managed by ZITADEL.
For example it would be possible to set the claim urn:zitadel:iam:user:resourceowner:name
{"urn:zitadel:iam:user:resourceowner:name": "ACME"}
if it was not set by ZITADEL itself.
To compensate for this we introduced a protection that does prevent actions from changing claims that start with urn:zitadel:iam
2.x versions are fixed on >= 2.48.3 2.47.x versions are fixed on >= 2.47.8 2.46.x versions are fixed on >= 2.46.5 2.45.x versions are fixed on >= 2.45.5 2.44.x versions are fixed on >= 2.44.7 2.43.x versions are fixed on >= 2.43.11 2.42.x versions are fixed on >= 2.42.17
No workaround available since a patch is available
Many thanks to @schettn whose disclosure of another topic lead us to find this issue.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí