PT-2018-9435 · Auth0 · Json-Jwt

Reedloden · Publicado 2018-06-26 · Atualizado 2018-09-02 · CVE-2018-1000539

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions json-jwt versions 0.5.0 through 1.9.3

Description The issue is related to the decryption of AES-GCM encrypted JSON Web Tokens, where an improper verification of cryptographic signatures can occur, allowing an attacker to forge an authentication tag. This can be exploited via network connectivity.

Recommendations For json-jwt versions 0.5.0 through 1.9.3, update to version 1.9.4 or later to resolve the issue.

Exploit

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2018-1000539

DSA-4283-1

GHSA-MJ4X-WCXF-HM8X

Produtos afetados

Json-Jwt

Referências · 19

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/json-jwt/CVE-2018-1000539.yml · Exploit
• https://github.com/nov/json-jwt/pull/62 · Nota
• https://github.com/nov/json-jwt/commit/3393f394f271c87bd42ec23c300727b4437d1638 · Nota
• https://github.com/nov/json-jwt/commit/a3b2147f0f6d9aca653e7a30e453d3a92b33413f · Nota
• https://github.com/nov/json-jwt · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000539 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000539 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000539 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1000539 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-4283-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000539 · Nota de Segurança
• https://security-tracker.debian.org/tracker/DSA-4283-1 · Aviso do Fabricante
• https://debian.org/security/2018/dsa-4283 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-1000539 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/source-package/ruby-json-jwt · Aviso do Fabricante