Skip to content

Releases: ory/hydra

v1.4.2+oryOS.18

03 Apr 15:16
@aeneasr aeneasr
v1.4.2
622b585
This commit was created on github.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.4.2+oryOS.18

Changelog

622b585 chore: move to ory analytics fork (#1776)
485961b docs: Regenerate and update changelog
77b82ac docs: Regenerate and update changelog
fab354a docs: add 1.4 section to upgrade guide

Docker images

  • docker pull oryd/hydra:v1
  • docker pull oryd/hydra:v1.4
  • docker pull oryd/hydra:v1.4.2
  • docker pull oryd/hydra:v1.4.2
  • docker pull oryd/hydra:latest
  • docker pull oryd/hydra:v1-alpine
  • docker pull oryd/hydra:v1.4-alpine
  • docker pull oryd/hydra:v1.4.2-alpine
  • docker pull oryd/hydra:v1.4.2-alpine
  • docker pull oryd/hydra:latest-alpine
Assets 18
Loading

v1.4.1+oryOS.18

02 Apr 10:11
@aeneasr aeneasr
v1.4.1
13c6753
This commit was created on github.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.4.1+oryOS.18

Changelog

13c6753 fix: add forgotten error check to test (#1774)

Docker images

  • docker pull oryd/hydra:v1
  • docker pull oryd/hydra:v1.4
  • docker pull oryd/hydra:v1.4.1
  • docker pull oryd/hydra:v1.4.1
  • docker pull oryd/hydra:latest
  • docker pull oryd/hydra:v1-alpine
  • docker pull oryd/hydra:v1.4-alpine
  • docker pull oryd/hydra:v1.4.1-alpine
  • docker pull oryd/hydra:v1.4.1-alpine
  • docker pull oryd/hydra:latest-alpine
Assets 18
Loading

v1.4.0+oryOS.18

02 Apr 09:37
@aeneasr aeneasr
v1.4.0
700d17d
This commit was created on github.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.4.0+oryOS.18 
Merge pull request from GHSA-3p3g-vpw6-4w66

BREAKING CHANGE: This patch requires a new SQL Table which needs to be created using `hydra migrate sql`. No other breaking changes have been introduced by this patch.

This patch introduces a blacklist for JTIs which prevents a potential replay of `private_key_jwt` JWTs when performing client authorization.

## GHSA-3p3g-vpw6-4w66

### Impact

When using client authentication method "private_key_jwt" [1], OpenId specification says the following about assertion `jti`:

> A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties

Hydra does not seem to check the uniqueness of this `jti` value. Here is me sending the same token request twice, hence with the same `jti` assertion, and getting two access tokens:

```
$ curl --insecure --location --request POST 'https://localhost/_/oauth2/token' \
   --header 'Content-Type: application/x-www-form-urlencoded' \
   --data-urlencode 'grant_type=client_credentials' \
   --data-urlencode 'client_id=c001d00d-5ecc-beef-ca4e-b00b1e54a111' \
   --data-urlencode 'scope=application openid' \
   --data-urlencode 'client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer' \
   --data-urlencode 'client_assertion=eyJhb [...] jTw'
{"access_token":"zeG0NoqOtlACl8q5J6A-TIsNegQRRUzqLZaYrQtoBZQ.VR6iUcJQYp3u_j7pwvL7YtPqGhtyQe5OhnBE2KCp5pM","expires_in":3599,"scope":"application openid","token_type":"bearer"}⏎            ~$ curl --insecure --location --request POST 'https://localhost/_/oauth2/token' \
   --header 'Content-Type: application/x-www-form-urlencoded' \
   --data-urlencode 'grant_type=client_credentials' \
   --data-urlencode 'client_id=c001d00d-5ecc-beef-ca4e-b00b1e54a111' \
   --data-urlencode 'scope=application openid' \
   --data-urlencode 'client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer' \
   --data-urlencode 'client_assertion=eyJhb [...] jTw'
{"access_token":"wOYtgCLxLXlELORrwZlmeiqqMQ4kRzV-STU2_Sollas.mwlQGCZWXN7G2IoegUe1P0Vw5iGoKrkOzOaplhMSjm4","expires_in":3599,"scope":"application openid","token_type":"bearer"}
```

### Severity

We rate the severity as medium because the following reasons make it hard to replay tokens without the patch:

- TLS protects against MITM which makes it difficult to intercept valid tokens for replay attacks
- The expiry time of the JWT gives only a short window of opportunity where it could be replayed

### Patches

This will be patched with v1.4.0+oryOS.17

### Workarounds

Two workarounds have been identified:

- Do not allow clients to use `private_key_jwt`
- Use short expiry times for the JWTs

### References

https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication

### Upstream

This issue will be resolved in the upstream repository https://github.com/ory/fosite
Assets 2
Loading

v1.3.2+oryOS.17

17 Feb 18:59
@aeneasr aeneasr
v1.3.2
388284f
Compare
Choose a tag to compare
v1.3.2+oryOS.17

Changelog

388284f chore: Regenerate swagger spec and internal client
2f9f103 docs: Regenerate and update changelog
07b82e1 fix(consent): Properly handle null handle_at

Docker images

  • docker pull oryd/hydra:v1
  • docker pull oryd/hydra:v1.3
  • docker pull oryd/hydra:v1.3.2
  • docker pull oryd/hydra:v1.3.2
  • docker pull oryd/hydra:latest
  • docker pull oryd/hydra:v1-alpine
  • docker pull oryd/hydra:v1.3-alpine
  • docker pull oryd/hydra:v1.3.2-alpine
  • docker pull oryd/hydra:v1.3.2-alpine
  • docker pull oryd/hydra:latest-alpine
Assets 18
Loading

v1.3.1+oryOS.17

16 Feb 13:23
@aeneasr aeneasr
v1.3.1
2fcf48a
This commit was signed with the committer’s verified signature. The key has expired.
aeneasr hackerman
GPG key ID: 998E76A674F4A689
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.3.1+oryOS.17

Changelog

2fcf48a ci: Bump SDK orb

Docker images

  • docker pull oryd/hydra:v1
  • docker pull oryd/hydra:v1.3
  • docker pull oryd/hydra:v1.3.1
  • docker pull oryd/hydra:v1.3.1
  • docker pull oryd/hydra:latest
  • docker pull oryd/hydra:v1-alpine
  • docker pull oryd/hydra:v1.3-alpine
  • docker pull oryd/hydra:v1.3.1-alpine
  • docker pull oryd/hydra:v1.3.1-alpine
  • docker pull oryd/hydra:latest-alpine
Assets 18
Loading

v1.3.0+oryOS.17

16 Feb 12:56
@aeneasr aeneasr
v1.3.0
513160b
Compare
Choose a tag to compare
v1.3.0+oryOS.17

Changelog

d3eac25 Add swagutil to tools (#1714)
2d8c1ec Update CHANGELOG [ci skip]
91d6737 Update CHANGELOG [ci skip]
46cf8eb chore: Regenerate swagger spec and internal client
8626d00 chore: Regenerate swagger spec and internal client
f24afe2 chore: Update go.mod
f4ddb17 ci: Add nancy CVE scanning orb (#1703)
af03094 ci: Bump golangci orb to 0.0.2
56b92bf ci: Bump orb versions
4a77b46 ci: Bump orbs
09c659a ci: Move linter to golangci-lint
a2393da ci: Use correct orb for golangci tasks
13c2216 docs: Prepare 1.3.0 release
c26a088 docs: Prepare ecosystem automation
35755bd docs: Regenerate and update changelog
a86c8e6 docs: Regenerate and update changelog
4ff179a docs: Regenerate and update changelog
7b89b43 docs: Regenerate and update changelog
513160b docs: Regenerate and update changelog
f11d143 docs: Regenerate and update changelog
f146fda docs: Regenerate and update changelog
15dfef0 docs: Remove examples section from ecosystem
694d333 docs: Updates issue and pull request templates (#1715)
d9308fa feat(consent)!: Track handled_at for consent requests (#1689)
715522a feat: New setting to specify SameSite cookie mode (#1718)
75126de fix(consent): Fix concurrent write and read on map (#1722)
d28d98d fix(consent): Resolve test issues
68f5b2d fix: Bump Go to 1.13 for e2e docker images
f1c926b fix: Resolve linter complaints
2bcd432 fix: Send 401 instead of 404 for unknown client (#1707)
aeecfe1 fix: Update for 5 minute tutorial (#1704)

Docker images

  • docker pull oryd/hydra:v1
  • docker pull oryd/hydra:v1.3
  • docker pull oryd/hydra:v1.3.0
  • docker pull oryd/hydra:v1.3.0
  • docker pull oryd/hydra:latest
  • docker pull oryd/hydra:v1-alpine
  • docker pull oryd/hydra:v1.3-alpine
  • docker pull oryd/hydra:v1.3.0-alpine
  • docker pull oryd/hydra:v1.3.0-alpine
  • docker pull oryd/hydra:latest-alpine
Assets 18
Loading

v1.2.3+oryOS.16

31 Jan 16:48
@aeneasr aeneasr
v1.2.3
ae4334d
Compare
Choose a tag to compare
v1.2.3+oryOS.16

Changelog

f83edb2 Small punctuation README change (#1713)
ae4334d Update CHANGELOG [ci skip]
5cd6736 Update CHANGELOG [ci skip]
4dd7acb Update CHANGELOG [ci skip]
3dd93a4 ci: Bump ory/sdk orb (#1709)
b0bf43f client: Remove merge client during update in memory (#1705)

Docker images

  • docker pull oryd/hydra:v1
  • docker pull oryd/hydra:v1.2
  • docker pull oryd/hydra:v1.2.3
  • docker pull oryd/hydra:v1.2.3
  • docker pull oryd/hydra:latest
  • docker pull oryd/hydra:v1-alpine
  • docker pull oryd/hydra:v1.2-alpine
  • docker pull oryd/hydra:v1.2.3-alpine
  • docker pull oryd/hydra:v1.2.3-alpine
  • docker pull oryd/hydra:latest-alpine
Assets 18
Loading

v1.2.2+oryOS.15

23 Jan 14:58
@aeneasr aeneasr
v1.2.2
2e285b9
This commit was created on github.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.2.2+oryOS.15

Changelog

37e96b7 Update CHANGELOG [ci skip]
cb7274f Update CHANGELOG [ci skip]
2e285b9 Updates configuration value for supported OIDC Subject Types (#1706)
7f84351 cmd: Fix logging Span ID (#1695)
cb5de79 docs: Updates issue and pull request templates (#1700)
5a27ab3 vendor: Update ory/x dependency to 0.0.89 (#1702)

Docker images

  • docker pull oryd/hydra:v1
  • docker pull oryd/hydra:v1.2
  • docker pull oryd/hydra:v1.2.2
  • docker pull oryd/hydra:v1.2.2
  • docker pull oryd/hydra:latest
  • docker pull oryd/hydra:v1-alpine
  • docker pull oryd/hydra:v1.2-alpine
  • docker pull oryd/hydra:v1.2.2-alpine
  • docker pull oryd/hydra:v1.2.2-alpine
  • docker pull oryd/hydra:latest-alpine
Assets 18
Loading

v1.2.1+oryOS.15

16 Jan 09:47
@aeneasr aeneasr
v1.2.1
6ab4587
Compare
Choose a tag to compare
v1.2.1+oryOS.15

Changelog

16df6f5 Merge branch 'master' of https://github.com/ory/hydra
9565bf3 Remove sdk/generate as dependency from changelog
fc16ab9 Update CHANGELOG [ci skip]
f40d2a8 Update CHANGELOG [ci skip]
9b83358 Update CHANGELOG [ci skip]
0761156 Update CHANGELOG [ci skip]
7cbeb97 Update CHANGELOG [ci skip]
6ab4587 Update CHANGELOG [ci skip]
8bd4e55 Update Consent API Swagger definitions (#1682)
bb41c80 Update SDK
f1b45c3 Update SDK
e21a6c0 Update SDK
23b209f Update SDK
4ad50ab ci: Use goreleaser orb (#1692)
d68838e consent: Restrict fc & bc logout to sid parameter (#1691)
51249b9 docker: Bump docker base images (#1686)
3cee9b1 server: Make logging traceable (#1685)

Docker images

  • docker pull oryd/hydra:v1
  • docker pull oryd/hydra:v1.2
  • docker pull oryd/hydra:v1.2.1
  • docker pull oryd/hydra:v1.2.1
  • docker pull oryd/hydra:latest
  • docker pull oryd/hydra:v1-alpine
  • docker pull oryd/hydra:v1.2-alpine
  • docker pull oryd/hydra:v1.2.1-alpine
  • docker pull oryd/hydra:v1.2.1-alpine
  • docker pull oryd/hydra:latest-alpine
Assets 18
Loading

v1.2.0+oryOS.15

08 Jan 12:07
@aeneasr aeneasr
v1.2.0
fabf0ca
Compare
Choose a tag to compare
v1.2.0+oryOS.15

Changelog

fabf0ca Update CHANGELOG [ci skip]
2b4fe8c Update SDK

Docker images

  • docker pull oryd/hydra:v1
  • docker pull oryd/hydra:v1.2
  • docker pull oryd/hydra:v1.2.0
  • docker pull oryd/hydra:v1.2.0
  • docker pull oryd/hydra:latest
  • docker pull oryd/hydra:v1-alpine
  • docker pull oryd/hydra:v1.2-alpine
  • docker pull oryd/hydra:v1.2.0-alpine
  • docker pull oryd/hydra:v1.2.0-alpine
  • docker pull oryd/hydra:latest-alpine
Assets 18
Loading