[DRE-maint] Bug#924747: ruby-doorkeeper-openid-connect: CVE-2019-9837

[Salvatore Bonaccorso]

Source: ruby-doorkeeper-openid-connect
Version: 1.5.2-1
Severity: grave
Tags: security upstream
Forwarded: https://github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/61

Hi,

The following vulnerability was published for ruby-doorkeeper-openid-connect.

CVE-2019-9837[0]:
| Doorkeeper::OpenidConnect (aka the OpenID Connect extension for
| Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the
| redirect_uri field in an OAuth authorization request (that results in
| an error response) with the 'openid' scope and a prompt=none value.
| This allows phishing attacks against the authorization flow.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-9837
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9837
[1] https://github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/61
[2] https://github.com/doorkeeper-gem/doorkeeper-openid_connect/pull/66

Regards,
Salvatore