Incorrect authorization in Google API Client Library for Java - CVE-2020-7692

Vulnerability identifier: #VU72076

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-7692

CWE-ID: CWE-863

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authorization process.

The vulnerability exists due to missing support for PKCE. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource.

Google API Client Library for Java
Red Hat OpenShift Container Platform
OpenShift Developer Tools and Services
IBM Business Automation Manager Open Editions
Autodesk Infraworks
IBM Maximo Asset Management
IBM Maximo Application Suite
cri-o (Red Hat package)
jenkins (Red Hat package)
jenkins-2-plugins (Red Hat package)
watsonx.data

Install updates from vendor's website.

Google API Client Library for Java - update to 1.31.0
Red Hat OpenShift Container Platform - addressed in versions 4.9.56, 4.10.51
IBM Business Automation Manager Open Editions - update to 8.0.7
Autodesk Infraworks - addressed in versions 2021.2 Hotfix 9, 2023.1 Hotfix 1
cri-o (Red Hat package) - addressed in versions 1.23.5-5.rhaos4.10.gitd9dec98.el7, 1.23.5-5.rhaos4.10.gitd9dec98.el8
watsonx.data - update to 2.0.2
jenkins (Red Hat package) - addressed in versions 2.361.1.1675668150-1.el8, 2.387.3.1684911776-3.el8, 2.414.3.1698293911-3.el8, 2.426.3.1706515686-3.el8
jenkins-2-plugins (Red Hat package) - addressed in versions 4.9.1675668922-1.el8, 4.10.1675144701-1.el8, 4.12.1698294000-1.el8, 4.12.1706515741-1.el8, 4.13.1684911916-1.el8
IBM Maximo Asset Management - addressed in versions 7.6.1.2.39, 7.6.1.3.13
IBM Maximo Application Suite - update to 8.6.7

• https://github.com/googleapis/google-oauth-java-client/commit/13433cd7dd06267fc261f0b1d4764f8e3432c824
• https://github.com/googleapis/google-oauth-java-client/issues/469
• https://tools.ietf.org/html/rfc8252%23section-8.1
• https://tools.ietf.org/html/rfc7636%23section-1
• https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEOAUTHCLIENT-575276
• https://lists.apache.org/thread.html/r3db6ac73e0558d64f0b664f2fa4ef0a865e57c5de20f8321d3b48678@%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/reae8909b264d1103f321b9ce1623c10c1ddc77dba9790247f2c0c90f@%3Ccommits.druid.apache.org%3E

• Missing authorization in Google OAuth Client Library for Java
• Multiple vulnerabilities in OpenShift Container Platform 4.10
• Multiple vulnerabilities in OpenShift Container Platform 4.9
• Multiple vulnerabilities in OpenShift Container Platform 4.9
• Multiple vulnerabilities in Autodesk InfraWorks
• OpenShift Developer Tools and Services for OCP 4.13 update for jenkins and jenkins-2-plugins
• Red Hat Product OCP Tools 4.12 update for Openshift Jenkins
• Multiple vulnerabilities in IBM Maximo Asset Management
• Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component
• OpenShift Developer Tools and Services for OCP 4.12 update for Jenkins and Jenkins-2-plugins
• Multiple vulnerabilities in IBM watsonx.data
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions