PT-2017-4203 · Nimbus · Nimbus Jose+Jwt

Published 2017-04-13 · Updated 2022-05-13 · CVE-2017-12974

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nimbus JOSE+JWT versions prior to 4.36

Description The issue concerns a problem with the construction of ECKey without proper validation of the public x and y coordinates on the specified curve, allowing for an Invalid Curve Attack in certain environments. This is related to incorrect cryptographic signature verification, which could potentially allow a remote attacker to impact the integrity of information.

Recommendations For versions prior to 4.36, update to version 4.36 or later to resolve the issue. As a temporary workaround, consider implementing additional curve validation checks in the JCE provider to minimize the risk of exploitation. Restrict the use of ECKey construction with unvalidated public x and y coordinates until the update is applied.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

CWE-310

Related Identifiers

BDU:2022-04735

CVE-2017-12974

GHSA-PFV2-37F7-9M6W

Affected Products

Nimbus Jose+Jwt

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2017-12974 · Security Note
• https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/217/explicit-check-for-ec-public-key-on-curve · Patch
• https://bdu.fstec.ru/vul/2022-04735 · Security Note
• https://osv.dev/vulnerability/GHSA-pfv2-37f7-9m6w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12974 · Vendor Advisory
• https://github.com/felx/nimbus-jose-jwt · Note
• https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt · Note
• https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E · Note
• https://vuldb.com/?id.105616 · Note
• https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f3a7a801f0c6b078899fed9226368eb7b44e2b2f · Note