league/oauth2-server key exposed in exception message when passing as string and providing invalid pass phrase

CVE-2023-37260

What is CVE-2023-37260?

The OAuth 2.0 authorization server from The PHP League had a vulnerability wherein keys passed as strings to the CryptKey constructor were exposed in LogicException messages. This occurred if a valid passphrase was not provided where necessary. The issue affected versions from 8.3.2 and below up to 8.5.2, allowing potential leakages of sensitive information. The vulnerability has been addressed in version 8.5.3, where the key is no longer revealed in exception messages. Users are strongly advised to upgrade to the patched version to enhance security. Alternatively, as a temporary measure, keys can be supplied as file paths instead of strings.

References