GHSA-xrhh-hx36-485q: Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands

GHSA-xrv8-2pf5-f3q7: nitro-tpm-pcr-compute may allow kernel command line modification by an account operator

GHSA-cmp6-m4wj-q63q: yawkat LZ4 Java has a possible information leak in Java safe decompressor

GHSA-4qg8-fj49-pxjh: Sigstore Timestamp Authority allocates excessive memory during request parsing

GHSA-f83f-xpx7-ffpw: Fulcio allocates excessive memory during token parsing

Previous to @2ca5bb1c2f11537be8f94ca6867d8d69789e744a (release [0.1.2](https://github.com/zf-fr/zfr-oauth2-server-module/tree/0.1.2)), tokens weren't checked for validity/expiration.

This potentially caused a security issue if expired tokens were not deleted after the expiration time was past, allowing anyone to still use invalidated authentication credentials.

**zfr authentication adapter did not verify validity of tokens**

High severity GitHub Reviewed Published Jun 7, 2024 to the GitHub Advisory Database

Headline

GHSA-rcm4-jv5g-wccm: zfr authentication adapter did not verify validity of tokens

ghsa: Latest News