PT-2018-9435 · Auth0 · Json-Jwt

Reedloden · Published 2018-06-26 · Updated 2018-09-02 · CVE-2018-1000539

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions json-jwt versions 0.5.0 through 1.9.3

Description The issue is related to the decryption of AES-GCM encrypted JSON Web Tokens, where an improper verification of cryptographic signatures can occur, allowing an attacker to forge an authentication tag. This can be exploited via network connectivity.

Recommendations For json-jwt versions 0.5.0 through 1.9.3, update to version 1.9.4 or later to resolve the issue.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2018-1000539

DSA-4283-1

GHSA-MJ4X-WCXF-HM8X

Affected Products

Json-Jwt

References · 19

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/json-jwt/CVE-2018-1000539.yml · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000539 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000539 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000539 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1000539 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4283-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000539 · Security Note
• https://security-tracker.debian.org/tracker/DSA-4283-1 · Vendor Advisory
• https://debian.org/security/2018/dsa-4283 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1000539 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/ruby-json-jwt · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-1000539 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1000539 · Security Note
• https://osv.dev/vulnerability/GHSA-mj4x-wcxf-hm8x · Vendor Advisory
• https://github.com/nov/json-jwt/pull/62 · Note