GHSA-vhmj-5q9r-mm9g: BlastRADIUS also affects eduMFA

July 17, 2024

BlastRADIUS (see blastradius.fail for details) also affects eduMFA prior version 2.2.0, because the Message-Authenticator attributes were not checked.

References

github.com/advisories/GHSA-vhmj-5q9r-mm9g
github.com/eduMFA/eduMFA
github.com/eduMFA/eduMFA/commit/ad9d18be31e8a6f536c646dc037d945de33fac60
github.com/eduMFA/eduMFA/security/advisories/GHSA-vhmj-5q9r-mm9g
kb.cert.org/vuls/id/456537
nvd.nist.gov/vuln/detail/CVE-2024-3596

Code Behaviors & Features

Detect and mitigate GHSA-vhmj-5q9r-mm9g with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →