Token Validity Bypass in Eclipse Dataspace Components

CVE-2024-8642

What is CVE-2024-8642?

A security vulnerability exists in the ConsumerPullTransferTokenValidationApiController of Eclipse Dataspace Components. Versions prior to 0.9.0 allow attackers to bypass token expiration checks due to inadequate validation of token attributes such as expiry, not-before, and issuance dates. This flaw requires a specific configuration: a dataplane setup that supports HTTP proxy consumer pull and includes the 'transfer-data-plane' module. Although the vulnerable code was deprecated in version 0.6.0, it has been completely removed in version 0.9.0, enhancing the security posture of the product.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References