CVE-2020-10187

Name	CVE-2020-10187
Description	Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret only intended for the OAuth application owner. After authorizing the application and allowing access, the attacker simply needs to request the list of their authorized applications in a JSON format (usually GET /oauth/authorized_applications.json). An application is vulnerable if the authorized applications controller is enabled.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	959903

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ruby-doorkeeper (PTS)	bookworm	5.5.0-2+deb12u1	fixed
	trixie	5.6.6-2	fixed
	forky, sid	5.9.6-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
ruby-doorkeeper	source	stretch	(not affected)
ruby-doorkeeper	source	buster	(not affected)
ruby-doorkeeper	source	(unstable)	5.0.3-1	959903

Notes

[buster] - ruby-doorkeeper <not-affected> (Vulnerable code not present)
[stretch] - ruby-doorkeeper <not-affected> (Vulnerable code not present)
https://github.com/doorkeeper-gem/doorkeeper/commit/25d038022c2fcad45af5b73f9d003cf38ff491f6
https://github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-j7vx-8mqj-cqp9
Introduced in https://github.com/doorkeeper-gem/doorkeeper/commit/4acc923dc77fa00928268136f54136d5a6a865dc (v5.0.0.rc1)