Bug 2081879 (CVE-2021-22573)

Summary:	CVE-2021-22573 google-oauth-client: Token signature not verified
Product:	[Other] Security Response	Reporter:	Patrick Del Bello <pdelbell>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abenaiss, aileenc, anstephe, aos-bugs, asoldano, ataylor, avibelli, bbaranow, bgeorges, bmaxwell, bmontgom, brian.stansberry, cdaley, cdewolf, chazlett, chfoley, clement.escoffier, cmiranda, dandread, darran.lofthouse, dbruscin, dfreiber, dkreling, dnakabaa, dosoudil, drieden, drow, eparis, ewolinet, fjuma, fmariani, fmongiar, ggaughan, gmalinko, gsmet, hamadhan, hbraun, istudens, ivassile, iweiss, janstey, jburrell, jcantril, jmartisk, jnethert, jochrist, jokerman, jpoth, jross, jschatte, jscholz, jwon, kaycoth, kholdawa, krathod, kvanderr, lcouzens, ldemasi, lgao, lthon, manderse, mizdebsk, mosmerov, mskarbek, msochure, msvehla, mszynkie, nstielau, nwallace, olubyans, pantinor, pbhattac, pcongius, pdelbell, peholase, periklis, pesilva, pgallagh, pjindal, pmackay, probinso, rareddy, rguimara, rkieley, rogbas, rojacob, rruss, rstancel, rstepani, rsvoboda, sbiarozk, scorneli, sdouglas, smaestri, spandura, sponnaga, swoodman, tcunning, tom.jenkinson, tqvarnst, vkumar, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	google-oauth-java-client 1.33.3	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Google OAuth Java client's IDToken verifier, where it does not verify if the token is properly signed. This issue could allow an attacker to provide a compromised token with a custom payload that will pass the validation on the client side, allowing access to information outside of their prescribed permissions.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-06-07 16:49:46 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2082345, 2082346, 2082347, 2082348, 2082349, 2082350, 2082351, 2082352
Bug Blocks:	2081880

Description Patrick Del Bello 2022-05-04 22:31:59 UTC

The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload. The token will pass the validation on the client side. We recommend upgrading to version 1.33.3 or above

https://github.com/googleapis/google-oauth-java-client/pull/872

Comment 3 Anten Skrabec 2022-05-05 20:28:18 UTC

Created byte-buddy tracking bugs for this issue:

Affects: fedora-all [bug 2082345]

Comment 11 errata-xmlrpc 2022-06-07 13:52:33 UTC

This issue has been addressed in the following products:

  Red Hat Fuse 7.10.2.P1

Via RHSA-2022:4932 https://access.redhat.com/errata/RHSA-2022:4932

Comment 12 Product Security DevOps Team 2022-06-07 16:49:42 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-22573

Comment 13 errata-xmlrpc 2022-06-14 14:46:38 UTC

This issue has been addressed in the following products:

  Red Hat Fuse Online 7.10.2.P1

Via RHSA-2022:5030 https://access.redhat.com/errata/RHSA-2022:5030

Comment 14 errata-xmlrpc 2022-07-07 14:23:11 UTC

This issue has been addressed in the following products:

  Red Hat Fuse 7.11

Via RHSA-2022:5532 https://access.redhat.com/errata/RHSA-2022:5532

Comment 17 errata-xmlrpc 2022-10-25 13:42:34 UTC

This issue has been addressed in the following products:

  RHINT Camel-Springboot 3.14.5

Via RHSA-2022:7177 https://access.redhat.com/errata/RHSA-2022:7177