REDHAT-BUG-2511992: Race Condition
A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.2.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.1.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.6.12
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs a single authorization code and must submit concurrent redemption requests. Successful exploitation causes that one code to produce multiple distinct valid access tokens.
Which versions contain the fix?
Upgrade to Apereo CAS version 4.2.3, 4.1.8, or 3.6.12. These versions fix the race condition in JCacheCodeDataProvider.