Bug#1010657: google-oauth-client-java: CVE-2021-22573 - IdTokenVerifier does not verify the signature of ID Token

2022-05-16 Thread tony mancill
Hi Markus, On Mon, May 16, 2022 at 12:52:59AM +0200, Markus Koschany wrote: > Hi tony, > > Am Sonntag, dem 15.05.2022 um 11:17 -0700 schrieb tony mancill: > > > [...] > > Any thoughts?  It's a tad messy either way, but using current versions > > simplifies the porting of patches. > > I haven't

Bug#1010657: google-oauth-client-java: CVE-2021-22573 - IdTokenVerifier does not verify the signature of ID Token

2022-05-15 Thread Markus Koschany
Hi tony, Am Sonntag, dem 15.05.2022 um 11:17 -0700 schrieb tony mancill: > [...] > Any thoughts?  It's a tad messy either way, but using current versions > simplifies the porting of patches. I haven't investigated the CVE closely enough but the current reverse- dependencies in Bullseye don't

Bug#1010657: google-oauth-client-java: CVE-2021-22573 - IdTokenVerifier does not verify the signature of ID Token

2022-05-15 Thread tony mancill
On Mon, May 09, 2022 at 09:23:36PM -0700, tony mancill wrote: > On Fri, May 06, 2022 at 09:46:24AM +0100, Neil Williams wrote: > > Source: google-oauth-client-java > > Version: 1.28.0-2 > > Severity: grave > > Tags: security > > Justification: user security hole > > > > Fixed in upstream release

Bug#1010657: google-oauth-client-java: CVE-2021-22573 - IdTokenVerifier does not verify the signature of ID Token

2022-05-09 Thread tony mancill
On Fri, May 06, 2022 at 09:46:24AM +0100, Neil Williams wrote: > Source: google-oauth-client-java > Version: 1.28.0-2 > Severity: grave > Tags: security > Justification: user security hole > > Hi, > > The following vulnerability was published for google-oauth-client-java. > > CVE-2021-22573[0]:

Bug#1010657: google-oauth-client-java: CVE-2021-22573 - IdTokenVerifier does not verify the signature of ID Token

2022-05-06 Thread Neil Williams
Source: google-oauth-client-java Version: 1.28.0-2 Severity: grave Tags: security Justification: user security hole X-Debbugs-Cc: codeh...@debian.org, Debian Security Team Hi, The following vulnerability was published for google-oauth-client-java. CVE-2021-22573[0]: | The vulnerability is