[Python-apps-team] Bug#929849: buildbot: CVE-2019-12300: OAuth vulnerability in using submitted authorization token for authentication

[Salvatore Bonaccorso]

Source: buildbot
Version: 2.0.1-1
Severity: grave
Tags: security upstream
Justification: user security hole

Hi,

The following vulnerability was published for buildbot.

CVE-2019-12300[0]:
| Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted
| authorization token from OAuth and uses it to authenticate a user. If
| an attacker has a token allowing them to read the user details of a
| victim, they can login as the victim.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-12300
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12300
[1] https://github.com/buildbot/buildbot/wiki/OAuth-vulnerability-in-using-submitted-authorization-token-for-authentication

The affected versions in [1] seem a bit missleading, because 2.x
versions up to 2.3.1 are affected as well, at least  2.0.1-1 as in
buster and sid has the problematic code.

Regards,
Salvatore