CVE-2020-10187

About two months ago, I found a CVE in a Ruby gem called Doorkeeper, and today the details were finally made public.

I found a couple of companies that were vulnerable in the wild, so it took some time to contact them and wait for them to patch their websites before the vulnerability was made public. I also worked with the gem maintainer to release a patch.

It's my first ever CVE, so I'm pretty proud of it.

Links:

• https://github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-j7vx-8mqj-cqp9
• https://about.gitlab.com/releases/2020/04/30/security-release-12-10-2-released/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10187

Comments

[rhymes]

Thank you very much Stefan! Your CVE is deeply appreciated :-)

[cryptomance]

Thanks for your contribution to a safer world!