Debian Package Tracker - ruby-doorkeeper

general

source: ruby-doorkeeper (main)
version: 5.3.0-2
maintainer: Debian Ruby Team (archive) (DMD)
uploaders: Pirate Praveen [DMD]
arch: all
std-ver: 4.5.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 4.2.0-3
old-bpo: 4.4.2-1~bpo9+1
stable: 4.4.2-1
stable-bpo: 5.3.0-2~bpo10+1
testing: 5.3.0-2
unstable: 5.3.0-2

versioned links

4.2.0-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.4.2-1~bpo9+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.4.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.3.0-2~bpo10+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.3.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

ruby-doorkeeper

action needed

A new upstream version is available: 5.4.0 high

A new upstream version 5.4.0 is available, you should consider packaging it.

Created: 2020-06-29 Last update: 2021-01-16 07:32

3 security issues in stretch high

There are 3 open security issues in stretch.

1 important issue:

CVE-2020-10187: Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret only intended for the OAuth application owner. After authorizing the application and allowing access, the attacker simply needs to request the list of their authorized applications in a JSON format (usually GET /oauth/authorized_applications.json). An application is vulnerable if the authorized applications controller is enabled.

2 issues skipped by the security teams:

CVE-2018-1000088: Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be exploitable via The victim must be tricked to click an opaque link to the web view that runs the XSS payload. A malicious version virtually indistinguishable from a normal link.. This vulnerability appears to have been fixed in 4.2.6, 4.3.0.
CVE-2018-1000211: Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.

Please fix them.

Created: 2018-02-22 Last update: 2020-12-03 06:03

1 security issue in buster high

There is 1 open security issue in buster.

1 important issue:

CVE-2020-10187: Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret only intended for the OAuth application owner. After authorizing the application and allowing access, the attacker simply needs to request the list of their authorized applications in a JSON format (usually GET /oauth/authorized_applications.json). An application is vulnerable if the authorized applications controller is enabled.

Please fix it.

Created: 2020-05-06 Last update: 2020-12-03 06:03

2 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 90c4cc9ca45e4cb0b94fc6ae990830debc60d2bd
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Fri Dec 25 14:56:41 2020 +0000

    Set upstream metadata fields: Security-Contact.
    
    Changes-By: lintian-brush

commit bd13795ce96de936c87790fe4692c05fcc751519
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Fri Dec 25 14:56:29 2020 +0000

    Update watch file format version to 4.
    
    Changes-By: lintian-brush
    Fixes: lintian: older-debian-watch-file-standard
    See-also: https://lintian.debian.org/tags/older-debian-watch-file-standard.html

Created: 2020-12-25 Last update: 2021-01-14 08:38

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.5.1 instead of 4.5.0).

Created: 2020-11-17 Last update: 2020-11-28 20:43

news

[rss feed]

[2020-12-03] Accepted ruby-doorkeeper 5.3.0-2~bpo10+1 (source all) into buster-backports (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2020-12-03] ruby-doorkeeper 5.3.0-2 MIGRATED to testing (Debian testing watch)
[2020-11-28] Accepted ruby-doorkeeper 5.3.0-2 (source) into unstable (Sruthi Chandran)
[2020-11-26] Accepted ruby-doorkeeper 5.3.0-1 (source) into unstable (Abraham Raji) (signed by: Sruthi Chandran)
[2020-05-27] ruby-doorkeeper 5.0.3-1 MIGRATED to testing (Debian testing watch)
[2020-05-25] Accepted ruby-doorkeeper 5.0.3-1~bpo10+1 (source) into buster-backports (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2020-05-22] Accepted ruby-doorkeeper 5.0.3-1 (source) into unstable (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2020-04-06] Accepted ruby-doorkeeper 5.0.2-2~bpo10+1 (source all) into buster-backports, buster-backports (Debian FTP Masters) (signed by: Praveen Arimbrathodiyil)
[2020-04-03] ruby-doorkeeper 5.0.2-2 MIGRATED to testing (Debian testing watch)
[2020-03-29] Accepted ruby-doorkeeper 5.0.2-2 (source) into unstable (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2020-02-27] Accepted ruby-doorkeeper 5.0.2-1 (source) into experimental (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2018-08-27] ruby-doorkeeper 4.4.2-1 MIGRATED to testing (Debian testing watch)
[2018-08-25] Accepted ruby-doorkeeper 4.4.2-1~bpo9+1 (source all) into stretch-backports (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2018-08-25] Accepted ruby-doorkeeper 4.4.2-1 (source) into unstable (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2018-05-15] Accepted ruby-doorkeeper 4.3.1-1~bpo9+1 (source all) into stretch-backports, stretch-backports (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2018-03-24] ruby-doorkeeper 4.3.1-1 MIGRATED to testing (Debian testing watch)
[2018-03-18] Accepted ruby-doorkeeper 4.3.1-1 (source) into unstable (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2016-09-07] ruby-doorkeeper 4.2.0-3 MIGRATED to testing (Debian testing watch)
[2016-09-01] Accepted ruby-doorkeeper 4.2.0-3 (source) into unstable (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2016-08-25] Accepted ruby-doorkeeper 4.2.0-2 (source all) into experimental (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2016-08-23] Accepted ruby-doorkeeper 4.2.0-1 (source all) into experimental (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2016-06-05] ruby-doorkeeper 3.1.0-1 MIGRATED to testing (Debian testing watch)
[2016-05-30] Accepted ruby-doorkeeper 3.1.0-1 (source all) into unstable (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2015-07-13] ruby-doorkeeper 2.2.1-1 MIGRATED to testing (Britney)
[2015-07-07] Accepted ruby-doorkeeper 2.2.1-1 (source all) into unstable, unstable (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)

bugs [bug history graph]

all: 0

links

homepage
lintian
buildd: logs, clang, reproducibility
popcon
browse source code
edit tags
other distros
security tracker
screenshots
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 5.3.0-2