[GHSA-g8pg-33v4-9r96] Thelia authentication bypass vulnerability

[RainSignal]

Updates

• Affected products
• Description

Comments
The advisory states the vulnerability is present from 2.1.0-beta1,
but code review shows this is incorrect. We examined the file
TokenProvider.php across multiple versions and confirmed the
vulnerable unserialize() code exists in all of them:

• 2.0.0-RC1: vulnerable (earliest version checked)
  https://github.com/thelia/thelia/blob/2.0.0-RC1/core/lib/Thelia/Core/Security/Token/TokenProvider.php
• 2.0.12: vulnerable
  https://github.com/thelia/thelia/blob/2.0.12/core/lib/Thelia/Core/Security/Token/TokenProvider.php
• 2.1.0-alpha2: vulnerable
  https://github.com/thelia/thelia/blob/2.1.0-alpha2/core/lib/Thelia/Core/Security/Token/TokenProvider.php
• 2.1.0-beta1: vulnerable
• 2.1.3: fixed

Since 2.0.0-RC1 is the earliest version we checked and already
contains the vulnerable code, the affected version range should
be updated to >= 2.0.0-RC1. The true introduction point may be
even earlier, but we could not confirm versions prior to 2.0.0-RC1.

Therefore, the affected versions should be changed from
">= 2.1.0-beta1, < 2.1.3" to "< 2.1.3".