| ID | PPSA-202401-1 |
|---|---|
| Published | 2024-01-03 |
| Private Packagist Cloud | Affected. Fixed on 2024-01-03. |
| Private Packagist Self-Hosted (KOTS) | Affected < 2.0.1. Fixed in 2.0.1. |
| Private Packagist Self-Hosted (Replicated Native) | Affected < 1.12.3. Fixed in 1.12.3. |
Summary
Links to reset a password stayed valid indefinitely instead of expiring.
Who was affected
All users of Private Packagist Cloud until the fix on January 3, 2024, and of Private Packagist Self-Hosted installations running a version before 2.0.1 (KOTS) or 1.12.3 (Replicated Native).
Impact
An attacker who obtained an old, unused password reset link of a user, for example from the user's email account, could have used it at any later time to set a new password for the user's Private Packagist account, take over the account, and use all of the user's access in Private Packagist.
What we did
Password reset links now expire after two hours, or as soon as the password is changed.
Do customers need to do anything
- Private Packagist Self-Hosted: Upgrade to 2.0.1 (KOTS) or 1.12.3 (Replicated Native) or any later version. We recommend upgrading to the latest release.
- Private Packagist Cloud: No action is required.
Credits
Thanks to Arslan for reporting this issue.
Start Free Trial
Login to create an organization and start your free trial!