ruby-doorkeeper - Debian Package Tracker

general

source: ruby-doorkeeper (main)
version: 5.3.0-2
maintainer: Debian Ruby Team (archive) (DMD)
uploaders: Pirate Praveen [DMD]
arch: all
std-ver: 4.5.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 4.2.0-3
old-bpo: 4.4.2-1~bpo9+1
stable: 4.4.2-1
stable-bpo: 5.3.0-2~bpo10+1
testing: 5.3.0-2
unstable: 5.3.0-2
exp: 5.5.0-1

versioned links

4.2.0-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.4.2-1~bpo9+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.4.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.3.0-2~bpo10+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.3.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.5.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

ruby-doorkeeper

action needed

A new upstream version is available: 5.5.1 high

A new upstream version 5.5.1 is available, you should consider packaging it.

Created: 2020-06-29 Last update: 2021-04-17 18:06

3 security issues in stretch high

There are 3 open security issues in stretch.

1 important issue:

CVE-2020-10187: Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret only intended for the OAuth application owner. After authorizing the application and allowing access, the attacker simply needs to request the list of their authorized applications in a JSON format (usually GET /oauth/authorized_applications.json). An application is vulnerable if the authorized applications controller is enabled.

2 issues postponed or untriaged:

CVE-2018-1000088: (needs triaging) Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be exploitable via The victim must be tricked to click an opaque link to the web view that runs the XSS payload. A malicious version virtually indistinguishable from a normal link.. This vulnerability appears to have been fixed in 4.2.6, 4.3.0.
CVE-2018-1000211: (needs triaging) Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.

Created: 2021-02-19 Last update: 2021-03-21 19:04

1 security issue in buster high

There is 1 open security issue in buster.

1 important issue:

CVE-2020-10187: Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret only intended for the OAuth application owner. After authorizing the application and allowing access, the attacker simply needs to request the list of their authorized applications in a JSON format (usually GET /oauth/authorized_applications.json). An application is vulnerable if the authorized applications controller is enabled.

Created: 2021-02-19 Last update: 2021-03-21 19:04

Fails to build during reproducibility testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2021-03-30 Last update: 2021-04-17 21:07

10 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit f139bf2889ee6b334c66b42444be8219233e186d
Merge: 64707d0 887c165
Author: Pirate Praveen <praveen@debian.org>
Date:   Thu Mar 11 16:09:59 2021 +0530

    Merge branch 'master-5.5'

commit 64707d0c114453a2b522f703fdc61a08bebfcab3
Merge: 90c4cc9 caab51e
Author: Pirate Praveen <praveen@debian.org>
Date:   Thu Mar 11 16:09:00 2021 +0530

    Update upstream source from tag 'upstream/5.5.0'
    
    Update to upstream version '5.5.0'
    with Debian dir b3d1d61466ea82ea7bf3ff25cde153a48b7991cd

commit caab51e4fb1bf2361158cf60b4005bc00951ae52
Author: Pirate Praveen <praveen@debian.org>
Date:   Thu Mar 11 16:09:00 2021 +0530

    New upstream version 5.5.0

commit 887c165779e8f6dbd6373e15c27834a4b8a0d48b
Author: Pirate Praveen <praveen@debian.org>
Date:   Thu Mar 11 15:54:50 2021 +0530

    Upload to experimental

commit 028b763baec34c6ed7cf33426d8a973238962695
Author: Pirate Praveen <praveen@debian.org>
Date:   Thu Mar 11 15:56:02 2021 +0530

    Drop patches (not required now)

commit 4ea97d3a525695e7b0ce55d811069b79a98c83ef
Author: Pirate Praveen <praveen@debian.org>
Date:   Thu Mar 11 15:54:33 2021 +0530

    Bump Standards-Version to 4.5.1 (no changes needed)

commit 2550b1cc7a4b7b26db5ff8d674a633693d4f37e6
Merge: 981ab5c 39c7f39
Author: Pirate Praveen <praveen@debian.org>
Date:   Thu Mar 11 15:53:52 2021 +0530

    Update upstream source from tag 'upstream/5.5.0'
    
    Update to upstream version '5.5.0'
    with Debian dir f1edc968fb38ba928a9a03c3f4f94292ed7a4521

commit 39c7f39ef63a1f369a4b8cb78a18841159cf7e6d
Author: Pirate Praveen <praveen@debian.org>
Date:   Thu Mar 11 15:53:52 2021 +0530

    New upstream version 5.5.0

commit 90c4cc9ca45e4cb0b94fc6ae990830debc60d2bd
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Fri Dec 25 14:56:41 2020 +0000

    Set upstream metadata fields: Security-Contact.
    
    Changes-By: lintian-brush

commit bd13795ce96de936c87790fe4692c05fcc751519
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Fri Dec 25 14:56:29 2020 +0000

    Update watch file format version to 4.
    
    Changes-By: lintian-brush
    Fixes: lintian: older-debian-watch-file-standard
    See-also: https://lintian.debian.org/tags/older-debian-watch-file-standard.html

Created: 2020-12-25 Last update: 2021-04-16 09:04

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.5.1 instead of 4.5.0).

Created: 2020-11-17 Last update: 2020-11-28 20:43

news

[rss feed]

[2021-03-11] Accepted ruby-doorkeeper 5.5.0-1 (source) into experimental (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2020-12-03] Accepted ruby-doorkeeper 5.3.0-2~bpo10+1 (source all) into buster-backports (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2020-12-03] ruby-doorkeeper 5.3.0-2 MIGRATED to testing (Debian testing watch)
[2020-11-28] Accepted ruby-doorkeeper 5.3.0-2 (source) into unstable (Sruthi Chandran)
[2020-11-26] Accepted ruby-doorkeeper 5.3.0-1 (source) into unstable (Abraham Raji) (signed by: Sruthi Chandran)
[2020-05-27] ruby-doorkeeper 5.0.3-1 MIGRATED to testing (Debian testing watch)
[2020-05-25] Accepted ruby-doorkeeper 5.0.3-1~bpo10+1 (source) into buster-backports (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2020-05-22] Accepted ruby-doorkeeper 5.0.3-1 (source) into unstable (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2020-04-06] Accepted ruby-doorkeeper 5.0.2-2~bpo10+1 (source all) into buster-backports, buster-backports (Debian FTP Masters) (signed by: Praveen Arimbrathodiyil)
[2020-04-03] ruby-doorkeeper 5.0.2-2 MIGRATED to testing (Debian testing watch)
[2020-03-29] Accepted ruby-doorkeeper 5.0.2-2 (source) into unstable (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2020-02-27] Accepted ruby-doorkeeper 5.0.2-1 (source) into experimental (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2018-08-27] ruby-doorkeeper 4.4.2-1 MIGRATED to testing (Debian testing watch)
[2018-08-25] Accepted ruby-doorkeeper 4.4.2-1~bpo9+1 (source all) into stretch-backports (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2018-08-25] Accepted ruby-doorkeeper 4.4.2-1 (source) into unstable (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2018-05-15] Accepted ruby-doorkeeper 4.3.1-1~bpo9+1 (source all) into stretch-backports, stretch-backports (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2018-03-24] ruby-doorkeeper 4.3.1-1 MIGRATED to testing (Debian testing watch)
[2018-03-18] Accepted ruby-doorkeeper 4.3.1-1 (source) into unstable (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2016-09-07] ruby-doorkeeper 4.2.0-3 MIGRATED to testing (Debian testing watch)
[2016-09-01] Accepted ruby-doorkeeper 4.2.0-3 (source) into unstable (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2016-08-25] Accepted ruby-doorkeeper 4.2.0-2 (source all) into experimental (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2016-08-23] Accepted ruby-doorkeeper 4.2.0-1 (source all) into experimental (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2016-06-05] ruby-doorkeeper 3.1.0-1 MIGRATED to testing (Debian testing watch)
[2016-05-30] Accepted ruby-doorkeeper 3.1.0-1 (source all) into unstable (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2015-07-13] ruby-doorkeeper 2.2.1-1 MIGRATED to testing (Britney)
[2015-07-07] Accepted ruby-doorkeeper 2.2.1-1 (source all) into unstable, unstable (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)

bugs [bug history graph]

all: 0

links

homepage
lintian
buildd: logs, exp, clang, reproducibility
popcon
browse source code
edit tags
other distros
security tracker
screenshots
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 5.3.0-2