PT-2024-23852 · Oidcc · Oidcc

Mohamedalikhechine + 2 · Published 2024-04-03 · Updated 2024-04-04 · CVE-2024-31209

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions oidcc versions prior to 3.0.2 oidcc versions prior to 3.1.2 oidcc versions prior to 3.2.0-beta.3

Description A Denial of Service (DoS) by Atom exhaustion is possible by calling oidcc provider configuration worker:get provider configuration/1 or oidcc provider configuration worker:get jwks/1. This issue is unlikely to be exploited since the name is usually provided as a static value in the application using oidcc. The vulnerability is present in oidcc provider configuration worker:get ets table name/1, where the function get ets table name is calling erlang:list to atom/1. There is a highly improbable case where the 2nd argument of oidcc provider configuration worker:get */1 is called with a different atom each time, leading to the atom table filling up and the node crashing.

Recommendations For oidcc versions prior to 3.0.2, update to version 3.0.2 or later. For oidcc versions prior to 3.1.2, update to version 3.1.2 or later. For oidcc versions prior to 3.2.0-beta.3, update to version 3.2.0-beta.3 or later. As a temporary workaround, make sure only valid provider configuration worker names are passed to the functions oidcc provider configuration worker:get provider configuration/1 and oidcc provider configuration worker:get jwks/1.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-31209

GHSA-MJ35-2RGF-CV8P

Affected Products

Oidcc

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31209.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-31209 · Security Note
• https://osv.dev/vulnerability/CVE-2024-31209 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mj35-2rgf-cv8p · Vendor Advisory
• https://github.com/erlef/oidcc · Note
• https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388 · Note
• https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p · Note
• https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c · Note
• https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649 · Note
• https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a · Note
• https://erlef.github.io/security-wg/secure_coding_and_deployment_hardening/atom_exhaustion.html · Note