Eclipse Data Plane Core
Monthly
Let me synthesize. Product: Siglet / Eclipse Data Plane Core. The description mentions "Siglet" refresh token handler, CPE says eclipse_data_plane_core. Primary product name — 1-3 words. Probably "Eclipse Data Plane Core" or "Siglet". Let me pick "Siglet" — hmm, the CPE is Eclipse Data Plane Core. The description says "In Siglet current and past versions". Siglet appears to be a component within Eclipse Data Plane Core (Eclipse Dataspace Components). Tags list Eclipse Data Plane Core. I'll use "Eclipse Data Plane Core" as primary? The rules say pick primary product. The CPE is the authoritative affected product. But description says Siglet. Hmm. I'll say "Siglet" — actually product_name 1-3 words only. Let me choose "Eclipse Data Plane Core" (4 words? Eclipse, Data, Plane, Core = 4 words). That violates 1-3 words. "Siglet" is 1 word. I'll go with "Siglet". Hmm, but the affected products refer to Eclipse Data Plane Core. Perhaps Siglet is the SSI/token component. I'll use "Siglet" as product name and mention Eclipse Data Plane Core in affected_products. Actually, to be safe, maybe "Eclipse Data Plane Core" — 4 words is over. Let's use "Siglet". CVSS 6.3, vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N — network, high complexity, no privileges, no UI, low impact on C/I/A. CWE-290: Authentication Bypass by Spoofing. Issue: refresh token handler does not enforce proof of possession of the issuer DID. So an attacker who obtains a refresh token (or can present a refresh token) without proving possession of the private key corresponding to the issuer DID can redeem it — token theft/replay allows issuing new access tokens. That's authentication bypass by spoofing: the token handler accepts a refresh token without verifying the DID key binding. Affected versions: Eclipse Data Plane Core 0.1.0 ≤ 0.1.3 and commit range a6f7d4cc... < 882fe22d... Patch: Available from vendor. The commit 882fe22db42bc67abfd0304c4cdb141b762c35d1 is likely the fix com
Let me synthesize. Product: Siglet / Eclipse Data Plane Core. The description mentions "Siglet" refresh token handler, CPE says eclipse_data_plane_core. Primary product name — 1-3 words. Probably "Eclipse Data Plane Core" or "Siglet". Let me pick "Siglet" — hmm, the CPE is Eclipse Data Plane Core. The description says "In Siglet current and past versions". Siglet appears to be a component within Eclipse Data Plane Core (Eclipse Dataspace Components). Tags list Eclipse Data Plane Core. I'll use "Eclipse Data Plane Core" as primary? The rules say pick primary product. The CPE is the authoritative affected product. But description says Siglet. Hmm. I'll say "Siglet" — actually product_name 1-3 words only. Let me choose "Eclipse Data Plane Core" (4 words? Eclipse, Data, Plane, Core = 4 words). That violates 1-3 words. "Siglet" is 1 word. I'll go with "Siglet". Hmm, but the affected products refer to Eclipse Data Plane Core. Perhaps Siglet is the SSI/token component. I'll use "Siglet" as product name and mention Eclipse Data Plane Core in affected_products. Actually, to be safe, maybe "Eclipse Data Plane Core" — 4 words is over. Let's use "Siglet". CVSS 6.3, vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N — network, high complexity, no privileges, no UI, low impact on C/I/A. CWE-290: Authentication Bypass by Spoofing. Issue: refresh token handler does not enforce proof of possession of the issuer DID. So an attacker who obtains a refresh token (or can present a refresh token) without proving possession of the private key corresponding to the issuer DID can redeem it — token theft/replay allows issuing new access tokens. That's authentication bypass by spoofing: the token handler accepts a refresh token without verifying the DID key binding. Affected versions: Eclipse Data Plane Core 0.1.0 ≤ 0.1.3 and commit range a6f7d4cc... < 882fe22d... Patch: Available from vendor. The commit 882fe22db42bc67abfd0304c4cdb141b762c35d1 is likely the fix com