The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload. The token will pass the validation on the client side. We recommend upgrading to version 1.33.3 or above https://github.com/googleapis/google-oauth-java-client/pull/872
Created byte-buddy tracking bugs for this issue: Affects: fedora-all [bug 2082345]
This issue has been addressed in the following products: Red Hat Fuse 7.10.2.P1 Via RHSA-2022:4932 https://access.redhat.com/errata/RHSA-2022:4932
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-22573
This issue has been addressed in the following products: Red Hat Fuse Online 7.10.2.P1 Via RHSA-2022:5030 https://access.redhat.com/errata/RHSA-2022:5030
This issue has been addressed in the following products: Red Hat Fuse 7.11 Via RHSA-2022:5532 https://access.redhat.com/errata/RHSA-2022:5532
This issue has been addressed in the following products: RHINT Camel-Springboot 3.14.5 Via RHSA-2022:7177 https://access.redhat.com/errata/RHSA-2022:7177