Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[JBEAP-26657] CVE-2024-1233 eap: JBoss EAP: wildfly-elytron has a SSRF security issue [eap-7.4.z] #2124

Merged
merged 2 commits into from
Apr 15, 2024
Merged

[JBEAP-26657] CVE-2024-1233 eap: JBoss EAP: wildfly-elytron has a SSRF security issue [eap-7.4.z] #2124

merged 2 commits into from
Apr 15, 2024

Conversation

ivassile
Copy link
Contributor

@ivassile ivassile requested a review from fjuma April 11, 2024 01:37
fjuma
fjuma approved these changes Apr 11, 2024
View reviewed changes
Copy link
Contributor

@fjuma fjuma left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @ivassile!

@fjuma
Copy link
Contributor

fjuma commented Apr 11, 2024

@Skyllarr CI seems to be failing for the 1.15.x branch but me and @ivassile aren't seeing the same failures locally. The failures also seem to be in the OIDC tests which aren't related to this change. Would you be able to take a look?

@Skyllarr
Copy link
Contributor

@ivassile @fjuma I also don't see the failures locally, I will take a closer look

@ivassile
Copy link
Contributor Author

@Skyllarr The errors are not related to this change. The same problem occurred when testing 1.15.x branch without any functional changes. See test PR #2125

@Skyllarr
Copy link
Contributor

@ivassile Does it occur in 2.x also? I'm wondering if the problem is connected to htlmunit dependency and they have the same version in both branches

@ivassile
Copy link
Contributor Author

@Skyllarr 2.x branch seems to be ok #2126

Skyllarr
Skyllarr approved these changes Apr 15, 2024
View reviewed changes
Copy link
Contributor

@Skyllarr Skyllarr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ivassile Thank you! Once the #2129 is merged, we can retest this PR

@Skyllarr
Copy link
Contributor

@ivassile Can you please rebase? Thanks!

@fjuma @ivassile
[JBEAP-26556] CVE-2024-1233 Validate the jku header parameter during
77c2a2a 
token validation to make sure it exactly matches a value from a
configured list of allowed values
@fjuma @ivassile
[JBEAP-26556] Move some methods from JwtSecurityRealmTest into a new
498d69a 
utility class
@Skyllarr Skyllarr merged commit 22b6185 into wildfly-security:1.15.x Apr 15, 2024
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@fjuma fjuma fjuma approved these changes

@Skyllarr Skyllarr Skyllarr approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@ivassile @fjuma @Skyllarr