Skip to content

4.2.0

Choose a tag to compare

View all tags
@aseigler aseigler released this 02 Oct 17:38
4.2.0
9218d55
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Full Changelog: 4.1.1...4.2.0

Security fixes for SSRF, an unauthenticated denial-of-service, and a metadata
validation bypass — see security advisory GHSA-jc6v-cf3v-w2fm for full details,
severity, and proof of concept.

  • SSRF via unpinned AIA fetches during attestation and MDS BLOB chain-building
  • Unauthenticated stack-overflow DoS in CBOR and ASN.1 decoding
  • Metadata cache poisoning for AAGUID-less (U2F) authenticators
  • Hardening: minimum challenge size, empty-challenge refusal, guarded topOrigin parsing

All Fido2 and Fido2.AspNet users on 4.x should upgrade to this version.

Assets 2
Loading