Description
Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source. This can leave servers vulnerable to replay attacks when TLS is not used. This vulnerability is fixed in 0.8.1.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
guzzle oauth-subscriber
< 0.8.1affected
References
- https://github.com/guzzle/oauth-subscriber/security/advisories/GHSA-237r-r8m4-4q88 ↗
- https://github.com/guzzle/oauth-subscriber/commit/92b619b03bd21396e51c62e6bce83467d2ce8f53 ↗
- https://github.com/guzzle/oauth-subscriber/blob/0.8.0/src/Oauth1.php#L192 ↗
- https://github.com/guzzle/oauth-subscriber/releases/tag/0.8.1 ↗