PT-2019-7833 · Php · Php Jose Library

CVE-2016-5431 · Publicado 2019-08-07 · Atualizado 2023-03-03

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions PHP JOSE Library versions prior to 2.2.1

Description The issue allows for key confusion/algorithm substitution in the JWS component, resulting in the bypassing of signature verification via crafted tokens.

Recommendations For versions prior to 2.2.1, update to version 2.2.1 or later to resolve the issue.

Correção

Use of a Broken Cryptographic Algorithm

Enumeração de Fraquezas

CWE-327

Identificadores relacionados

CVE-2016-5431

GHSA-XM5F-HC9R-76F3

Produtos afetados

Php Jose Library

Referências · 5

• https://github.com/nov/jose-php/commit/1cce55e27adf0274193eb1cd74b927a398a3df4b · Correção
• https://github.com/nov/jose-php · Nota
• https://osv.dev/vulnerability/CVE-2016-5431 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-5431 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-xm5f-hc9r-76f3 · Aviso do Fabricante