CVE-2023-37260: league/oauth2-server key exposed in exception message when passing as string and providing invalid pass phrase
First published: Thu Jul 06 2023(Updated: )
### Impact Servers that passed their keys to the CryptKey constructor as as string instead of a file path will have had that key included in a LogicException message if they did not provide a valid pass phrase for the key where required. ### Patches This issue has been patched so that the provided key is no longer exposed in the exception message in the scenario outlined above. Users should upgrade to version 8.5.3 or 8.4.2 to receive the patch. ### Workarounds We recommend upgrading the oauth2-server to one of the patched releases (8.5.3 or 8.4.2). If you are unable to upgrade you can avoid this security issue by passing your key as a file instead of a string. ### References * [Fix for 8.4.x](https://github.com/thephpleague/oauth2-server/pull/1359) * [Fix for 8.5.x](https://github.com/thephpleague/oauth2-server/pull/1353)
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/league/oauth2-server | >=8.5.0<8.5.3 | 8.5.3 |
| composer/league/oauth2-server | >=8.3.2<8.4.2 | 8.4.2 |
| Thephpleague Oauth2-server | >=8.3.2<8.5.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/thephpleague/oauth2-server/security/advisories/GHSA-wj7q-gjg8-3cpm
- https://nvd.nist.gov/vuln/detail/CVE-2023-37260
- https://github.com/thephpleague/oauth2-server/pull/1353
- https://github.com/thephpleague/oauth2-server/releases/tag/8.5.3
- https://github.com/thephpleague/oauth2-server/pull/1359
- https://github.com/advisories/GHSA-wj7q-gjg8-3cpm (Advisory)
Frequently Asked Questions
What is the impact of CVE-2023-37260?
Servers that passed their keys to the CryptKey constructor as a string instead of a file path will have had that key included in a LogicException message if they did not provide a valid pass phrase for the key where required.
How can I fix CVE-2023-37260?
Update league/oauth2-server to version 8.5.3 or apply patch 8.4.2 if using versions between 8.3.2 and 8.5.3.
What is the severity of CVE-2023-37260?
The severity of CVE-2023-37260 is high with a score of 8.2.
Where can I find more information about CVE-2023-37260?
You can find more information about CVE-2023-37260 at the following references: [Github Security Advisory](https://github.com/thephpleague/oauth2-server/security/advisories/GHSA-wj7q-gjg8-3cpm), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-37260), [Github Pull Request](https://github.com/thephpleague/oauth2-server/pull/1353).
What CWE categories are associated with CVE-2023-37260?
CVE-2023-37260 is associated with CWE-200 (Information Exposure) and CWE-209 (Information Exposure Through an Error Message).
- collector/github-advisory
- alias/GHSA-wj7q-gjg8-3cpm
- alias/CVE-2023-37260
- collector/github-advisory-latest
- collector/nvd-index
- collector/nvd-cve
- agent/references
- agent/author
- agent/type
- agent/softwarecombine
- agent/weakness
- agent/severity
- agent/title
- agent/remedy
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- package-manager/composer
- vendor/thephpleague
- canonical/thephpleague oauth2-server
- version/thephpleague oauth2-server/8.3.2