PT-2017-4230 · Nimbus · Nimbus Jose+Jwt

Published 2017-04-13 · Updated 2022-05-13 · CVE-2017-12973

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nimbus JOSE+JWT versions prior to 4.39

Description The issue is related to the improper handling of an invalid HMAC in authenticated AES-CBC decryption, allowing attackers to conduct a padding oracle attack. This is due to a lack of integrity checking in the HMAC component of the Nimbus JOSE+JWT Java library. Exploitation of this issue may allow a remote attacker to disclose protected information.

Recommendations For versions prior to 4.39, update to version 4.39 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data until the update is applied.

Fix

Weakness Enumeration

CWE-354

Related Identifiers

BDU:2022-07422

CVE-2017-12973

GHSA-JFMQ-4G4M-99RH

Affected Products

Nimbus Jose+Jwt

References · 9

• https://osv.dev/vulnerability/CVE-2017-12973 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-07422 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-12973 · Security Note
• https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/6a29f10f723f406eb25555f55842c59a43a38912 · Patch
• https://osv.dev/vulnerability/GHSA-jfmq-4g4m-99rh · Vendor Advisory
• https://vuldb.com/?id.105615 · Note
• https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt · Note
• https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/223/aescbc-return-immediately-on-invalid-hmac · Note
• https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/6a29f10f723f406eb25555f55842c59a43a38912%20%D0%9F%D0%BB%D0%B0%D1%81%D1%82%D1%8B%D1%80%D1%8C · Note