PT-2019-11486 · Perl · Perl-Crypt-Jwt

Publicado 2019-07-25 · Atualizado 2020-08-24 · CVE-2019-1010161

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: perl-CRYPT-JWT versions 0.022 and earlier

Description: The issue is related to incorrect access control, allowing bypass authentication. It affects the JWT.pm component for JWT security tokens, specifically in the decode jws() function at line 614. The attack vector involves network connectivity, where an attacker can craft user-controlled input to bypass authentication.

Recommendations: For versions 0.022 and earlier, update to version 0.023 to resolve the issue. As a temporary workaround, consider restricting access to the JWT.pm component or limiting network connectivity to minimize the risk of exploitation.

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2019-1010161

Produtos afetados

Perl-Crypt-Jwt

Referências · 3

• https://github.com/DCIT/perl-Crypt-JWT/issues/3#issuecomment-417947483 · Nota
• https://osv.dev/vulnerability/CVE-2019-1010161 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010161 · Nota de Segurança