PT-2017-4230 · Nimbus · Nimbus Jose+Jwt

Publicado 2017-04-13 · Atualizado 2022-05-13 · CVE-2017-12973

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nimbus JOSE+JWT versions prior to 4.39

Description The issue is related to the improper handling of an invalid HMAC in authenticated AES-CBC decryption, allowing attackers to conduct a padding oracle attack. This is due to a lack of integrity checking in the HMAC component of the Nimbus JOSE+JWT Java library. Exploitation of this issue may allow a remote attacker to disclose protected information.

Recommendations For versions prior to 4.39, update to version 4.39 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data until the update is applied.

Correção

Enumeração de Fraquezas

CWE-354

Identificadores relacionados

BDU:2022-07422

CVE-2017-12973

GHSA-JFMQ-4G4M-99RH

Produtos afetados

Nimbus Jose+Jwt

Referências · 9

• https://vuldb.com/?id.105615 · Nota
• https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt · Nota
• https://osv.dev/vulnerability/CVE-2017-12973 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2022-07422 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2017-12973 · Nota de Segurança
• https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/223/aescbc-return-immediately-on-invalid-hmac · Nota
• https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/6a29f10f723f406eb25555f55842c59a43a38912%20%D0%9F%D0%BB%D0%B0%D1%81%D1%82%D1%8B%D1%80%D1%8C · Nota
• https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/6a29f10f723f406eb25555f55842c59a43a38912 · Correção
• https://osv.dev/vulnerability/GHSA-jfmq-4g4m-99rh · Aviso do Fabricante