Add CVE-2020-15222 for GHSA-v3q9-2p3m-7g43

2020/15xxx/CVE-2020-15222.json

@@ -1,18 +1,93 @@
 {
-    "data_type": "CVE",
-    "data_format": "MITRE",
-    "data_version": "4.0",
     "CVE_data_meta": {
+        "ASSIGNER": "security-advisories@github.com",
         "ID": "CVE-2020-15222",
-        "ASSIGNER": "cve@mitre.org",
-        "STATE": "RESERVED"
+        "STATE": "PUBLIC",
+        "TITLE": "Replay of private_key_jwt possible in ORY Fosite"
     },
+    "affects": {
+        "vendor": {
+            "vendor_data": [
+                {
+                    "product": {
+                        "product_data": [
+                            {
+                                "product_name": "fosite",
+                                "version": {
+                                    "version_data": [
+                                        {
+                                            "version_value": "< 0.31.0"
+                                        }
+                                    ]
+                                }
+                            }
+                        ]
+                    },
+                    "vendor_name": "ory"
+                }
+            ]
+        }
+    },
+    "data_format": "MITRE",
+    "data_type": "CVE",
+    "data_version": "4.0",
     "description": {
         "description_data": [
             {
                 "lang": "eng",
-                "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+                "value": "In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using \"private_key_jwt\" authentication the uniqueness of the `jti` value is not checked.\n\nWhen using client authentication method \"private_key_jwt\", OpenId specification says the following about assertion `jti`: \"A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties\".\n\nHydra does not seem to check the uniqueness of this `jti` value.\n\nThis problem is fixed in version 0.31.0."
             }
         ]
+    },
+    "impact": {
+        "cvss": {
+            "attackComplexity": "LOW",
+            "attackVector": "NETWORK",
+            "availabilityImpact": "NONE",
+            "baseScore": 8.1,
+            "baseSeverity": "HIGH",
+            "confidentialityImpact": "HIGH",
+            "integrityImpact": "HIGH",
+            "privilegesRequired": "NONE",
+            "scope": "UNCHANGED",
+            "userInteraction": "REQUIRED",
+            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
+            "version": "3.1"
+        }
+    },
+    "problemtype": {
+        "problemtype_data": [
+            {
+                "description": [
+                    {
+                        "lang": "eng",
+                        "value": "CWE-287: Improper Authentication"
+                    }
+                ]
+            }
+        ]
+    },
+    "references": {
+        "reference_data": [
+            {
+                "name": "https://github.com/ory/fosite/security/advisories/GHSA-v3q9-2p3m-7g43",
+                "refsource": "CONFIRM",
+                "url": "https://github.com/ory/fosite/security/advisories/GHSA-v3q9-2p3m-7g43"
+            },
+            {
+                "name": "https://github.com/ory/fosite/commit/0c9e0f6d654913ad57c507dd9a36631e1858a3e9",
+                "refsource": "MISC",
+                "url": "https://github.com/ory/fosite/commit/0c9e0f6d654913ad57c507dd9a36631e1858a3e9"
+            },
+            {
+                "name": "https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication",
+                "refsource": "MISC",
+                "url": "https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication"
+            }
+        ]
+    },
+    "source": {
+        "advisory": "GHSA-v3q9-2p3m-7g43",
+        "discovery": "UNKNOWN"
     }
 }