CVE-2022-31053

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-31053

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-31053.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2022-31053

Aliases

Published

2022-06-13T19:35:10Z

Modified

2026-08-19T11:47:55.115264790Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Signature forgery in Biscuit

Details

Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification. There are no known workarounds for this issue.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-347"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31053.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "biscuit-auth >= 1.0.0, < 2.0.0"
                },
                {
                    "last_affected": "biscuit-auth >= 1.0.0, < 2.0.0"
                },
                {
                    "introduced": "biscuit-haskell = 0.1.1.0"
                },
                {
                    "last_affected": "biscuit-haskell = 0.1.1.0"
                },
                {
                    "introduced": "com.clever-cloud.biscuit-java < 2.0.0"
                },
                {
                    "last_affected": "com.clever-cloud.biscuit-java < 2.0.0"
                },
                {
                    "introduced": "github.com/biscuit-auth/biscuit-go < 2.0"
                },
                {
                    "last_affected": "github.com/biscuit-auth/biscuit-go < 2.0"
                }
            ]
        }
    ]
}

References

Affected packages

Git

github.com/clevercloud/biscuit-java

Affected ranges

Type

GIT

Repo

https://github.com/clevercloud/biscuit-java

Events

Introduced

Fixed

0864a220cfdad3809b8fddf2a8b0922e6572b6be

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.0"
        }
    ],
    "cpe": "cpe:2.3:a:clever-cloud:biscuit-java:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE"
}

Affected versions

0.*

0.1.2

0.1.3

0.2.3

0.2.4

0.2.5

0.2.6

0.2.7

0.3.0

0.3.1

0.4.0

0.4.1

0.5.0

0.5.1

0.6.0

0.6.1

1.*

1.0-SNAPSHOT

1.0.0

1.0.1

1.0.10

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

v0.*

v0.1.0

v0.2.0

v0.2.1

v0.2.2

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-31053.json"

github.com/eclipse-biscuit/biscuit-go

Affected ranges

Type

GIT

Repo

https://github.com/eclipse-biscuit/biscuit-go

Events

Introduced

Fixed

f061134c2a1e56aa4f3166e633b0afc27acd09f3

Database specific

Show details

{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:biscuitsec:biscuit-go:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.0"
        }
    ]
}

Affected versions

v1.*

v1.0.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-31053.json"

github.com/eclipse-biscuit/biscuit-haskell

Affected ranges

Type

GIT

Repo

https://github.com/eclipse-biscuit/biscuit-haskell

Events

Introduced

18e0ffd9e0ad7ed59c1668baa2efb3bbd1b0beb2

Last affected

18e0ffd9e0ad7ed59c1668baa2efb3bbd1b0beb2

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0.1.1.0"
        },
        {
            "last_affected": "0.1.1.0"
        }
    ],
    "cpe": "cpe:2.3:a:biscuitsec:biscuit-haskell:0.1.1.0:*:*:*:*:*:*:*",
    "source": "CPE_STRING"
}

Affected versions

0.*

0.1.1.0

v0.*

v0.1.1.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-31053.json"

github.com/eclipse-biscuit/biscuit-rust

Affected ranges

Type

GIT

Repo

https://github.com/eclipse-biscuit/biscuit-rust

Events

Introduced

6ffb05581990552dd1c6a64220279bb24b0a0495

Last affected

122c61cc7b7faec46ec25cd7314238d8852687f1

Database specific

Show details

{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:biscuitsec:biscuit-auth:*:*:*:*:*:rust:*:*",
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "last_affected": "1.1.0"
        }
    ]
}

Affected versions

1.*

1.0.0

1.0.1

1.1.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-31053.json"