Approved changes feed: RSS · Atom
cpe:2.3:a:digitalbazaar:zcap:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Digitalbazaar (bcd71b0c-c63e-5277-b5cf-17c38b69e02f) |
|---|---|
| Product | Zcap (ca002433-23ed-55f8-92c0-a194a94a87c1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-31995 |
vulnerable | 2026-06-08 06:35:32.579618 |
zcap has incomplete expiration checks in capability chains.
MEDIUM (4.3)
`@digitalbazaar/zcap` provides JavaScript reference implementation for Authorization Capabilities. Prior to version 9.0.1, when invoking a capability with a chain depth of 2, i.e., it is delegated directly from the root capability, the `expires` property is not properly checked against the current date or other `date` param. This can allow invocations outside of the original intended time period. A zcap still cannot be invoked without being able to use the associated private key material. `@digitalbazaar/zcap` v9.0.1 fixes expiration checking. As a workaround, one may revoke a zcap at any time.
Published: 2024-04-10T21:57:41.129Z
Updated: 2024-08-02T01:59:50.785Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.