Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 17 Dec 2014 12:57:44 -0500
From: Tute Costa <>
Subject: CSRF vulnerability in doorkeeper OAuth provider rubygem

Cross-site request forgery (CSRF) vulnerability in doorkeeper 1.4.0
and earlier allows remote attackers to hijack the user's OAuth
autorization code. This vulnerability has been assigned the CVE
identifier CVE-2012-5664.

Versions Affected:  1.4.0 and below
Fixed Versions:     1.4.1, 2.0.0


Doorkeeper's endpoints didn't have CSRF protection. Any HTML document
on the Internet can then read a user's authorization code with
arbitrary scope from any Doorkeeper-compatible Rails app you are
logged in.


The 1.4.1 and 2.0.0 releases are available at and

Upgrade Process

Upgrade doorkeeper version at least to 1.4.1.


There are no feasible workarounds for this vulnerability.

Thanks to Sergey Belov of DigitalOcean for finding the vulnerability,
Phill Baker of DigitalOcean for reporting and fixing it, and to Egor
Homakov of for raising awareness.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.