Improper Verification of Cryptographic Signature in Google API Client Library for Java - CVE-2021-22573

Vulnerability identifier: #VU64471

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-22573

CWE-ID: CWE-347

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to IDToken verifier does not verify if token is properly signed. A remote authenticated user can provide a compromised token with custom payload and gain access to sensitive information.

Google API Client Library for Java
IBM Qradar SIEM
Fuse
Oracle Middleware Common Libraries and Tools
Autodesk Infraworks
IBM Maximo Asset Management
IBM Maximo Application Suite
openSUSE Leap
openEuler
google-oauth-java-client-help
google-oauth-java-client
google-oauth-java-client-servlet
google-oauth-java-client-parent
google-oauth-java-client-java6
google-oauth-java-client-javadoc
watsonx.data
Red Hat Camel for Spring Boot

Install updates from vendor's website.

Google API Client Library for Java - update to 1.33.3
Fuse - update to 7.10.2-P1
Autodesk Infraworks - addressed in versions 2021.2 Hotfix 9, 2023.1 Hotfix 1
google-oauth-java-client-help - update to 1.22.0-6
google-oauth-java-client - update to 1.22.0-6
google-oauth-java-client-servlet - update to 1.22.0-150200.3.7.1
google-oauth-java-client-parent - update to 1.22.0-150200.3.7.1
google-oauth-java-client - update to 1.22.0-150200.3.7.1
google-oauth-java-client-java6 - update to 1.22.0-150200.3.7.1
google-oauth-java-client-javadoc - update to 1.22.0-150200.3.7.1
watsonx.data - update to 2.0.2
Red Hat Camel for Spring Boot - update to 3.14.5
IBM Maximo Asset Management - addressed in versions 7.6.1.2.39, 7.6.1.3.13
IBM Maximo Application Suite - update to 8.6.7

• https://github.com/googleapis/google-oauth-java-client/pull/872
• https://bugzilla.redhat.com/show_bug.cgi?id=2081879

• Improper Verification of Cryptographic Signature in Google API Client Library for Java
• Multiple vulnerabilities in Red Hat Fuse
• Improper Verification of Cryptographic Signature in Red hat Fuse
• Information disclosure in Red Hat Camel for Spring Boot
• Multiple vulnerabilities in Autodesk InfraWorks
• Improper verification of cryptographic signature in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Maximo Asset Management
• Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component
• SUSE update for google-oauth-java-client
• Multiple vulnerabilities in IBM watsonx.data
• openEuler 22.03 LTS SP4 update for google-oauth-java-client
• openEuler 22.03 LTS SP3 update for google-oauth-java-client
• openEuler 20.03 LTS SP4 update for google-oauth-java-client
• openEuler 24.03 LTS SP2 update for google-oauth-java-client
• openEuler 24.03 LTS SP1 update for google-oauth-java-client
• openEuler 24.03 LTS update for google-oauth-java-client
• Multiple vulnerabilities in Oracle Middleware Common Libraries and Tools