PT-2010-1186 · Michaelliao · Openid

Michaelliao · Published 2010-07-15 · Updated 2024-05-17 · CVE-2010-10006

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions michaelliao jopenid versions prior to 1.08

Description The issue is related to a timing discrepancy in the getAuthentication function of the OpenIdManager.java file. This discrepancy can be exploited by a remote attacker to gain unauthorized access to protected information. The complexity of an attack is rather high, and the exploitability is difficult.

Recommendations To address this issue, upgrade to version 1.08 or later. As a temporary workaround, consider restricting access to the getAuthentication function until a patch is applied.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-208

Related Identifiers

BDU:2023-00595

CVE-2010-10006

GHSA-M4F8-P58G-J8MJ

Affected Products

Openid

References · 8

• https://github.com/michaelliao/jopenid/releases/tag/JOpenId-1.08 · Patch
• https://github.com/michaelliao/jopenid/commit/c9baaa976b684637f0d5a50268e91846a7a719ab · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2010-10006 · Security Note
• https://osv.dev/vulnerability/GHSA-m4f8-p58g-j8mj · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00595 · Security Note
• https://vuldb.com/?ctiid.218460 · Note
• https://vuldb.com/?id.218460 · Note
• https://t.me/cvenotify/59356 · Telegram Post