Advisories for Maven/Org.http4k/Http4k-Security-Digest package

An issue in DigestAuthProvider.verify: Algorithm silently forced to MD5. The configured algorithm parameter was ignored — every verification used MD5 regardless of configuration. Deployments believing they were running SHA-256 Digest auth were silently inheriting MD5's collision weaknesses, including documented attack paths against Digest schemes that rely on the hash being collision-resistant. Who is affected: any application using http4k-security-digest for HTTP Digest authentication. The bug has been present since DigestAuthProvider was …

An issue in DigestAuthProvider.verify: The uri parameter in the client's Authorization: Digest … response was not checked against the actual request URL. A captured Digest authentication response could be replayed against any other URL served by the same realm, breaking the per-request-URL binding the Digest scheme assumes. Who is affected: any application using http4k-security-digest for HTTP Digest authentication. The bug has been present since DigestAuthProvider was introduced (commit 8a52b615b1, 2021).

ServerFilters.DigestAuth and the underlying DigestAuthProvider both defaulted their nonceVerifier parameter to { true } — i.e. every nonce was accepted regardless of value, age, or prior use. Any deployment using the default configuration had no replay protection on Digest authentication; a captured Authorization: Digest … response could be replayed indefinitely against the same protected resource. The nonce-verification mechanism in Digest auth is the primary anti-replay control — without it, Digest …