Vulnerability-Lookup

CVE-2024-31209 (GCVE-0-2024-31209)

Vulnerability from cvelistv5 – Published: 2024-04-04 16:04 – Updated: 2024-09-03 18:26

Title

OpenID Connect client Atom Exhaustion in provider configuration worker ets table location

Summary

oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` & `3.2.0-beta.3`.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

GitHub_M

References

5 references

URL	Tags
https://github.com/erlef/oidcc/security/advisorie…	x_refsource_CONFIRM
https://github.com/erlef/oidcc/commit/2f304d877c7…	x_refsource_MISC
https://github.com/erlef/oidcc/commit/48171fb6268…	x_refsource_MISC
https://github.com/erlef/oidcc/commit/ac458ed88dc…	x_refsource_MISC
https://github.com/erlef/oidcc/blob/018dbb53dd752…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
erlef	oidcc	Affected: >= 3.0.0, < 3.0.2 Affected: >= 3.1.0, < 3.1.2 Affected: >= 3.2.0-beta.1, < 3.2.0-beta.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T01:46:04.592Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p"
          },
          {
            "name": "https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c"
          },
          {
            "name": "https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649"
          },
          {
            "name": "https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a"
          },
          {
            "name": "https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-31209",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-07T15:32:55.551475Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T18:26:21.909Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "oidcc",
          "vendor": "erlef",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.0.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.0, \u003c 3.1.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.2.0-beta.1, \u003c 3.2.0-beta.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` \u0026 `3.2.0-beta.3`."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-04T16:04:43.255Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p"
        },
        {
          "name": "https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c"
        },
        {
          "name": "https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649"
        },
        {
          "name": "https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a"
        },
        {
          "name": "https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388"
        }
      ],
      "source": {
        "advisory": "GHSA-mj35-2rgf-cv8p",
        "discovery": "UNKNOWN"
      },
      "title": "OpenID Connect client Atom Exhaustion in provider configuration worker ets table location"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-31209",
    "datePublished": "2024-04-04T16:04:43.255Z",
    "dateReserved": "2024-03-29T14:16:31.900Z",
    "dateUpdated": "2024-09-03T18:26:21.909Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-31209",
      "date": "2026-06-10",
      "epss": "0.00021",
      "percentile": "0.06192"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` \u0026 `3.2.0-beta.3`.\"}, {\"lang\": \"es\", \"value\": \"oidcc es la librer\\u00eda cliente OpenID Connect para Erlang. La denegaci\\u00f3n de servicio (DoS) por agotamiento de Atom es posible llamando a `oidcc_provider_configuration_worker:get_provider_configuration/1` o `oidcc_provider_configuration_worker:get_jwks/1`. Este problema se ha solucionado en las versiones `3.1.2` y `3.2.0-beta.3`.\"}]",
      "id": "CVE-2024-31209",
      "lastModified": "2024-11-21T09:13:02.683",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 0.8, \"impactScore\": 4.0}]}",
      "published": "2024-04-04T16:15:09.550",
      "references": "[{\"url\": \"https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-400\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-31209\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-04-04T16:15:09.550\",\"lastModified\":\"2024-11-21T09:13:02.683\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` \u0026 `3.2.0-beta.3`.\"},{\"lang\":\"es\",\"value\":\"oidcc es la librer\u00eda cliente OpenID Connect para Erlang. La denegaci\u00f3n de servicio (DoS) por agotamiento de Atom es posible llamando a `oidcc_provider_configuration_worker:get_provider_configuration/1` o `oidcc_provider_configuration_worker:get_jwks/1`. Este problema se ha solucionado en las versiones `3.1.2` y `3.2.0-beta.3`.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.8,\"impactScore\":4.0}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]}],\"references\":[{\"url\":\"https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p\", \"name\": \"https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c\", \"name\": \"https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649\", \"name\": \"https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a\", \"name\": \"https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388\", \"name\": \"https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T01:46:04.592Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-31209\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-07T15:32:55.551475Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-03T18:26:15.482Z\"}}], \"cna\": {\"title\": \"OpenID Connect client Atom Exhaustion in provider configuration worker ets table location\", \"source\": {\"advisory\": \"GHSA-mj35-2rgf-cv8p\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"erlef\", \"product\": \"oidcc\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 3.0.0, \u003c 3.0.2\"}, {\"status\": \"affected\", \"version\": \"\u003e= 3.1.0, \u003c 3.1.2\"}, {\"status\": \"affected\", \"version\": \"\u003e= 3.2.0-beta.1, \u003c 3.2.0-beta.3\"}]}], \"references\": [{\"url\": \"https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p\", \"name\": \"https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c\", \"name\": \"https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649\", \"name\": \"https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a\", \"name\": \"https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388\", \"name\": \"https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` \u0026 `3.2.0-beta.3`.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400: Uncontrolled Resource Consumption\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-04-04T16:04:43.255Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-31209\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-03T18:26:21.909Z\", \"dateReserved\": \"2024-03-29T14:16:31.900Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-04-04T16:04:43.255Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-31209

Vulnerability from fkie_nvd - Published: 2024-04-04 16:15 - Updated: 2026-04-15 00:35

Severity

5.3 (Medium) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388
	security-advisories@github.com	https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c
	security-advisories@github.com	https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649
	security-advisories@github.com	https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a
	security-advisories@github.com	https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` \u0026 `3.2.0-beta.3`."
    },
    {
      "lang": "es",
      "value": "oidcc es la librer\u00eda cliente OpenID Connect para Erlang. La denegaci\u00f3n de servicio (DoS) por agotamiento de Atom es posible llamando a `oidcc_provider_configuration_worker:get_provider_configuration/1` o `oidcc_provider_configuration_worker:get_jwks/1`. Este problema se ha solucionado en las versiones `3.1.2` y `3.2.0-beta.3`."
    }
  ],
  "id": "CVE-2024-31209",
  "lastModified": "2026-04-15T00:35:42.020",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-04-04T16:15:09.550",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-MJ35-2RGF-CV8P

Vulnerability from github – Published: 2024-04-03 16:46 – Updated: 2025-04-04 01:10

Summary

OpenID Connect client Atom Exhaustion in provider configuration worker ets table location

Details

Impact

DOS by Atom exhaustion is possible by calling oidcc_provider_configuration_worker:get_provider_configuration/1 or oidcc_provider_configuration_worker:get_jwks/1.

Since the name is usually provided as a static value in the application using oidcc, this is unlikely to be exploited.

Details

Example to illustrate the vulnerability.

{ok, Claims} =
  oidcc:retrieve_userinfo(
    Token,
    myapp_oidcc_config_provider,
    <<"client_id">>,
    <<"client_secret">>,
    #{}
  )

The vulnerability is present in oidcc_provider_configuration_worker:get_ets_table_name/1. The function get_ets_table_name is calling erlang:list_to_atom/1.

https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388

There might be a case (Very highly improbable) where the 2nd argument of oidcc_provider_configuration_worker:get_*/1 is called with a different atom each time which eventually leads to the atom table filling up and the node crashing.

Patches

Patched in 3.0.2, 3.1.2 & 3.2.0-beta.3

Workarounds

Make sure only valid provider configuration worker names are passed to the functions.

References

https://erlef.github.io/security-wg/secure_coding_and_deployment_hardening/atom_exhaustion.html
https://www.cve.org/CVERecord?id=CVE-2024-31209
https://euvd.enisa.europa.eu/enisa/EUVD-2024-1249
https://github.com/advisories/GHSA-mj35-2rgf-cv8p

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "oidcc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Hex",
        "name": "oidcc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Hex",
        "name": "oidcc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.2.0-beta.1"
            },
            {
              "fixed": "3.2.0-beta.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-31209"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-03T16:46:30Z",
    "nvd_published_at": "2024-04-04T16:15:09Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nDOS by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`.\n\nSince the name is usually provided as a static value in the application using `oidcc`, this is unlikely to be exploited.\n\n### Details\n\nExample to illustrate the vulnerability.\n\n```erlang\n{ok, Claims} =\n  oidcc:retrieve_userinfo(\n    Token,\n    myapp_oidcc_config_provider,\n    \u003c\u003c\"client_id\"\u003e\u003e,\n    \u003c\u003c\"client_secret\"\u003e\u003e,\n    #{}\n  )\n```\n\nThe vulnerability is present in `oidcc_provider_configuration_worker:get_ets_table_name/1`.\nThe function `get_ets_table_name` is calling `erlang:list_to_atom/1`.\n\nhttps://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388\n\nThere might be a case (Very highly improbable) where the 2nd argument of\n`oidcc_provider_configuration_worker:get_*/1` is called with a different atom each time which eventually leads to\nthe atom table filling up and the node crashing.\n\n### Patches\n\nPatched in `3.0.2`, `3.1.2` \u0026 `3.2.0-beta.3`\n\n### Workarounds\n\nMake sure only valid provider configuration worker names are passed to the functions.\n\n### References\n\n* https://erlef.github.io/security-wg/secure_coding_and_deployment_hardening/atom_exhaustion.html\n* https://www.cve.org/CVERecord?id=CVE-2024-31209\n* https://euvd.enisa.europa.eu/enisa/EUVD-2024-1249\n* https://github.com/advisories/GHSA-mj35-2rgf-cv8p",
  "id": "GHSA-mj35-2rgf-cv8p",
  "modified": "2025-04-04T01:10:32Z",
  "published": "2024-04-03T16:46:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31209"
    },
    {
      "type": "WEB",
      "url": "https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649"
    },
    {
      "type": "WEB",
      "url": "https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a"
    },
    {
      "type": "WEB",
      "url": "https://erlef.github.io/security-wg/secure_coding_and_deployment_hardening/atom_exhaustion.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/erlef/oidcc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenID Connect client Atom Exhaustion in provider configuration worker ets table location"
}

GSD-2024-31209

Vulnerability from gsd - Updated: 2024-04-03 05:02

Details

Aliases

CVE-2024-31209

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-31209"
      ],
      "details": "oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` \u0026 `3.2.0-beta.3`.",
      "id": "GSD-2024-31209",
      "modified": "2024-04-03T05:02:25.539104Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2024-31209",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "oidcc",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 3.0.0, \u003c 3.0.2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 3.1.0, \u003c 3.1.2"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 3.2.0-beta.1, \u003c 3.2.0-beta.3"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "erlef"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` \u0026 `3.2.0-beta.3`."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-400",
                "lang": "eng",
                "value": "CWE-400: Uncontrolled Resource Consumption"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p",
            "refsource": "MISC",
            "url": "https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p"
          },
          {
            "name": "https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c",
            "refsource": "MISC",
            "url": "https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c"
          },
          {
            "name": "https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649",
            "refsource": "MISC",
            "url": "https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649"
          },
          {
            "name": "https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a",
            "refsource": "MISC",
            "url": "https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a"
          },
          {
            "name": "https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388",
            "refsource": "MISC",
            "url": "https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-mj35-2rgf-cv8p",
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` \u0026 `3.2.0-beta.3`."
          }
        ],
        "id": "CVE-2024-31209",
        "lastModified": "2024-04-04T16:33:06.610",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 0.8,
              "impactScore": 4.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-04-04T16:15:09.550",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/erlef/oidcc/commit/2f304d877c7e0613d6fd952d7feacbf40dbc355c"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/erlef/oidcc/commit/48171fb62688fb4eec1ead0884aa501e0aa68649"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/erlef/oidcc/commit/ac458ed88dc292aad6fa7343f6a53e73c560fb1a"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-400"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-31209 (GCVE-0-2024-31209)

FKIE_CVE-2024-31209

GHSA-MJ35-2RGF-CV8P

Impact

Details

Patches

Workarounds

References

GSD-2024-31209

Tags

Sightings

Nomenclature