CVE:CVE-2017-18076
CNNVD:CNNVD-201801-1036
OmniAuth是一套利用Rack中间件实现的认证系统。
OmniAuth 1.3.2之前的版本中的strategy.rb文件存在安全漏洞，该漏洞源于程序没有正确的保护authenticity_token值。攻击者可利用该漏洞获取令牌。
solution:Upgrade omniauth omniauth to a higher version than 1.3.2,and avoid the version (,1.3.2); Upgrade debian debian_linux to a higher version than 8.0,9.0,and avoid the version 8.0,9.0