Boruta 0.10.0 Security Patch: OAuth Atom Exhaustion & Credential Masking

Vulnerability Intelligence Summary 1. Vulnerability Overview Key Vulnerabilities: - Atomic exhaustion risk in OAuth token value handling: In the module, the handling of OAuth token values does not account for the risk of atomic exhaustion. - Exposure of local runtime artifacts: In the module, the exposure of local runtime artifacts has been reduced. - Security of request handling: In the module, the handling of malformed requests is more secure. - Atomic exhaustion risk in user preference value handling: In the module, the handling of user preference values does not account for the risk of atomic exhaustion. - Sanitization of development environment default values: In the module, development environment default values have been sanitized. - Size limit on aggregated log responses: In the module, the size of aggregated log responses is constrained. - Masking of OAuth credentials: In the module, OAuth credentials have been masked in logs. - Removal of local deployment keys: In the module, local deployment keys have been removed. - Closing of SSE streams: In the module, SSE streams are properly closed when the client disconnects. - Secure cookie requirement: In the module, the use of secure cookies is required. 2. Impact Scope Affected Modules: - : OAuth token value handling. - : Exposure of local runtime artifacts, malformed request handling. - : User preference value handling, development environment default values. - : Size limit on aggregated log responses, masking of OAuth credentials, removal of local deployment keys. - : Closing of SSE streams, secure cookie requirement. 3. Fix Details Fix Versions: - 0.10.0: - : HTTP and HTTPS forward proxy, HTTPS gateway and sidecar listeners, service registration root CA and node certificate generation, service registration records expose node gateway and proxy listener configuration, service registration records expose certificate paths and node certificates, gateway listeners configurable via and , upstreams can require TLS, static configuration supports node aliases, service registration node upstreams displayed in the upstreams section, gateway and proxy configurations collapsed within service registration records, EPMD cluster hosts configurable via , Docker Compose runs multiple Boruta nodes with static gateway configuration. - : Mesh proxy traffic routed through service registration records, upstream creation and editing uses service registration records, publishing node distribution and cookies configurable via environment variables. - : Docker Compose runs multiple Boruta nodes with static gateway configuration. - 0.9.2: - : Integration tests for OID4VC credential issuance and OID4VP direct POST flow. - : (Breaking change) Credential and key selection uses password-protected local storage. - : URI rewriting only updates the request line path. - : Prompt and request object declarations validated before public client flows, prompts for users requiring re-authentication, max age parameter must be fully parsed, WebAuthn state cleared after authorization errors, upstream TLS hostname validation, HEAD request forwarding, upstream matching ignores query strings and uses the longest matching upstream URI, Authorization header matching token schemes are case-insensitive, upstream store notification de-duplication, malformed Content-Length responses handled securely, authentication flow state cleared upon login, authentication query parameters correctly parsed, session marked as selected after user selection. - 0.9.1: - : Upstreams can restrict traffic, request and business event history in the admin dashboard, admins can view user identifiers in the user list, operators can benchmark OAuth authorizations and gateway requests, request count documentation for OAuth and OpenID4VC flows. - : OAuth acceptor count is configurable, defaulting to 8. - : Gateway acceptor count configurable, authorization returns clearer OAuth error responses, authorization includes configured scopes, keepalive tuning removed from gateway configuration, deployment keys provided via environment variables, gateway configuration fields are more readable, users see their usernames instead of email addresses. - : Verifiable credential array declarations can be deleted, feedback forms, gateway dashboard request timing charts, upstream routes correctly match paths, token headers for empty forwards are ignored, successful requests appear in logs, users are correctly redirected after federated login, federated error pages render correctly. - : Upgraded vulnerable npm packages, OAuth token value handling free from atomic exhaustion risk, reduced exposure of local runtime artifacts, safer handling of malformed requests, user preference value handling free from atomic exhaustion risk, sanitized development environment default values, size limit on aggregated log responses, OAuth credentials masked from logs, local deployment keys removed, SSE streams closed on client disconnection, secure cookies required.

Goal Reached Thanks to every supporter — we hit 100%!

Boruta 0.10.0 Security Patch: OAuth Atom Exhaustion & Credential Masking

More from this source