GHSA-f28g-86hc-823q: Tokenizer vulnerable to client brute-force of token secrets

July 13, 2023 (updated May 20, 2024)

Authorized clients, having an inject_processor secret, could brute-force the secret token value by abusing the fmt parameter to the Proxy-Tokenizer header.

References

github.com/advisories/GHSA-f28g-86hc-823q
github.com/superfly/tokenizer
github.com/superfly/tokenizer/pull/8
github.com/superfly/tokenizer/pull/9
github.com/superfly/tokenizer/security/advisories/GHSA-f28g-86hc-823q

Code Behaviors & Features

Detect and mitigate GHSA-f28g-86hc-823q with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →