CVE-2020-36599: Improper Encoding or Escaping of Output

August 19, 2022 (updated August 31, 2022)

lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.

References

github.com/advisories/GHSA-pm55-qfxr-h247
github.com/omniauth/omniauth/commit/43a396f181ef7d0ed2ec8291c939c95e3ed3ff00
nvd.nist.gov/vuln/detail/CVE-2020-36599
rubygems.org/gems/omniauth/versions/1.9.2

Code Behaviors & Features

Detect and mitigate CVE-2020-36599 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →