VDB
Sign up
MEDIUM5.9

GHSA-9jr3-rj99-8jq3

CoreWCF: SAML token replay protection is inoperative

Quick fix

GHSA-9jr3-rj99-8jq3 — CoreWCF.Primitives: upgrade to the fixed version with the command below.

dotnet add package CoreWCF.Primitives --version 1.8.1

Details

### Impact When enabling DetectReplayedTokens, a token can be replayed and will be detected despite it being reused.

### Patches Fixed in CoreWCF v1.8.1 and v1.9.1

### Workarounds Provide your own implementation of `ITokenReplayCache` with the correct behavior.

Are you affected?

Enter the version of the package you're using.

Affected packages

NuGet/CoreWCF.Primitives
Introduced in: 0Fixed in: 1.8.1
Fixdotnet add package CoreWCF.Primitives --version 1.8.1
NuGet/CoreWCF.Primitives
Introduced in: 1.9.0Fixed in: 1.9.1
Fixdotnet add package CoreWCF.Primitives --version 1.9.1

References