CVE-2023-37260: league/oauth2-server key exposed in exception message when passing as a string and providing an invalid pass phrase
Impact Servers that passed their keys to the CryptKey constructor as as string instead of a file path will have had that key included in a LogicException message if they did not provide a valid pass phrase for the key where required.
Patches This issue has been patched so that the provided key is no longer exposed in the exception message in the scenario outlined above. Users should upgrade to version 8.5.3 or 8.4.2 to receive the patch.
Workarounds We recommend upgrading the oauth2-server to one of the patched releases (8.5.3 or 8.4.2). If you are unable to upgrade you can avoid this security issue by passing your key as a file instead of a string.
References Fix for 8.4.x Fix for 8.5.x
Other sources
league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP. Starting in version 8.3.2 and prior to version 8.5.3, servers that passed their keys to the CryptKey constructor as as string instead of a file path will have had that key included in a LogicException message if they did not provide a valid pass phrase for the key where required. This issue has been patched so that the provided key is no longer exposed in the exception message in the scenario outlined above. Users should upgrade to version 8.5.3 to receive the patch. As a workaround, pass the key as a file instead of a string.
— MITRE
league/oauth2-server key exposed in exception message when passing as a string and providing an invalid pass phrase
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/league/oauth2-serverto a version that resolves this vulnerability.Fixed in 8.5.3 - Upgrade
Upgrade
composer/league/oauth2-serverto a version that resolves this vulnerability.Fixed in 8.4.2 - Upgrade
Upgrade
league/oauth2-serverto a version that resolves this vulnerability.Fixed in 8.5.3 - Upgrade
Upgrade
league/oauth2-serverto a version that resolves this vulnerability.Fixed in 8.4.2 - Configuration
Pass the key as a file path instead of as a string.
league/oauth2-server CryptKey key input = file path
Event History
Frequently Asked Questions
What is the impact of CVE-2023-37260?
Servers that passed their keys to the CryptKey constructor as a string instead of a file path will have had that key included in a LogicException message if they did not provide a valid pass phrase for the key where required.
How can I fix CVE-2023-37260?
Update league/oauth2-server to version 8.5.3 or apply patch 8.4.2 if using versions between 8.3.2 and 8.5.3.
What is the severity of CVE-2023-37260?
The severity of CVE-2023-37260 is high with a score of 8.2.
Where can I find more information about CVE-2023-37260?
You can find more information about CVE-2023-37260 at the following references: [Github Security Advisory](https://github.com/thephpleague/oauth2-server/security/advisories/GHSA-wj7q-gjg8-3cpm), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-37260), [Github Pull Request](https://github.com/thephpleague/oauth2-server/pull/1353).
What CWE categories are associated with CVE-2023-37260?
CVE-2023-37260 is associated with CWE-200 (Information Exposure) and CWE-209 (Information Exposure Through an Error Message).