org.openidentityplatform.openam:openam-auth-webauthn@16.0.2

latest version

16.1.2

latest non vulnerable version

16.1.2

first published

5 years ago

latest version published

16 days ago

licenses detected

(CC-BY-NC-ND-3.0 OR CDDL-1.0)
[14.5.2,)

package registry

View on Maven Central Repository

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.openidentityplatform.openam:openam-auth-webauthn package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
C Deserialization of Untrusted Data Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialization process of untrusted data in the WebAuthn authentication module. An attacker can execute arbitrary code in the context of the application server by supplying crafted serialized objects to a storage attribute that is attacker-writable and read by the WebAuthn module. This is only exploitable if the storage attribute or `userAttribute` is configured to be user-writable, which is not the default configuration but can occur through delegated administration, provisioning, write access to the backing directory, legacy REST self-registration, or unsafe reconfiguration. How to fix Deserialization of Untrusted Data? Upgrade `org.openidentityplatform.openam:openam-auth-webauthn` to version 16.1.1 or higher.	[,16.1.1)

Deserialization of Untrusted Data

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialization process of untrusted data in the WebAuthn authentication module. An attacker can execute arbitrary code in the context of the application server by supplying crafted serialized objects to a storage attribute that is attacker-writable and read by the WebAuthn module. This is only exploitable if the storage attribute or userAttribute is configured to be user-writable, which is not the default configuration but can occur through delegated administration, provisioning, write access to the backing directory, legacy REST self-registration, or unsafe reconfiguration.

How to fix Deserialization of Untrusted Data?

Upgrade org.openidentityplatform.openam:openam-auth-webauthn to version 16.1.1 or higher.

[,16.1.1)

Go back to all versions of this package