Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

omniauth

3 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3
Registry
RubyGems

Advisories 3

  • lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.

    Affected: fixed in 1.9.2; from 2.0.0.pre.rc1, fixed in 2.0.0.

  • The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby…

    Affected: fixed in 2.0.0.

  • In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters…

    Affected: fixed in 1.3.2.