CVE-2017-1000070: URL Redirection to Untrusted Site ('Open Redirect')

December 20, 2021

The Bitly oauth2_proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and termination of the 2-legged OAuth flow. This issue was caused by improper input validation and a violation of RFC-6819

References

github.com/advisories/GHSA-jm34-xm8m-w958
github.com/bitly/oauth2_proxy/commit/289a6ccf463a425c7606178c510fc5eeb9c8b050
github.com/bitly/oauth2_proxy/issues/228
github.com/bitly/oauth2_proxy/pull/359
nvd.nist.gov/vuln/detail/CVE-2017-1000070
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000070

Code Behaviors & Features

Detect and mitigate CVE-2017-1000070 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →