CVE-2017-18076: POST params leakage

January 26, 2018 (updated October 3, 2019)

In strategy.rb in OmniAuth, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.

References

bugs.debian.org/888523
github.com/omniauth/omniauth/pull/867
nvd.nist.gov/vuln/detail/CVE-2017-18076

Code Behaviors & Features

Detect and mitigate CVE-2017-18076 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →