Threats affecting pkg:brew/charmcraft

OAuthLib versions from 3.5.1_1 up to but not including 4.4.2_1 contain a vulnerability in the device workflow implementation of the OAuth 2.0 device authorization grant (RFC 8628). The token endpoint does not validate the device_code parameter, allowing an attacker who knows a valid client ID with device workflow enabled to obtain a bearer token without a valid device_code. This flaw arises because the DeviceCodeGrant.validate_token_request method lacks proper device_code validation. A fix is available in version 4.4.2_1.

A vulnerability in h11 versions before 0.15.0 allows lenient parsing of chunked HTTP message bodies, which can cause request smuggling when combined with a buggy proxy that parses chunked encoding differently. This discrepancy can lead to attackers bypassing protections or stealing credentials by manipulating HTTP requests. The issue is fixed in h11 version 0.15.0.