PT-2022-17592 · Passport+1 · Passport+1

Jaredhanson + 3 · Published 2022-07-01 · Updated 2022-07-13 · CVE-2022-25896

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions passport versions prior to 0.6.0

Description The issue affects the passport package, causing the session to be regenerated instead of being closed when a user logs in or logs out.

Recommendations For versions prior to 0.6.0, update to version 0.6.0 or later to resolve the issue.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2022-25896

GHSA-V923-W3X8-WH69

SNYK-JS-PASSPORT-2840631

Affected Products

Debian

Passport

References · 14

• https://github.com/jaredhanson/passport/pull/900 · Patch
• https://github.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-25896 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25896 · Security Note
• https://snyk.io/vuln/SNYK-JS-PASSPORT-2840631 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-25896 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25896 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-25896 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v923-w3x8-wh69 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-25896 · Security Note
• https://ubuntu.com/security/CVE-2022-25896 · Vendor Advisory
• https://github.com/jaredhanson/passport · Note
• https://t.me/cibsecurity/45537 · Telegram Post
• https://t.me/cvenotify/32532 · Telegram Post