[OAK-8870] UserAuthentication.authenticate should remove pw attribute

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 1.2, 1.4, 1.6.0, 1.8.0, 1.10.0, 1.12.0, 1.14.0, 1.16.0, 1.18.0, 1.20.0, 1.22.0
• Fix Version/s: 1.24.0, 1.10.8, 1.6.20, 1.4.26, 1.8.20, 1.22.1
• Component/s: core, security
• Assignee: Angela Schreiber
• Reporter: Angela Schreiber
• Created: 24/Jan/20 15:18
• Updated: 16/Feb/21 09:53
• Resolved: 24/Jan/20 15:20

Description

I noticed that UserAuthentication.authenticate(Credentials) does not remove the optional CREDENTIALS_ATTRIBUTE_NEWPASSWORD upon completion of the authentication step.

Issue Links

• links to: CVE-2020-1940