PT-2019-11486 · Perl · Perl-Crypt-Jwt

Published 2019-07-25 · Updated 2020-08-24 · CVE-2019-1010161

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: perl-CRYPT-JWT versions 0.022 and earlier

Description: The issue is related to incorrect access control, allowing bypass authentication. It affects the JWT.pm component for JWT security tokens, specifically in the decode jws() function at line 614. The attack vector involves network connectivity, where an attacker can craft user-controlled input to bypass authentication.

Recommendations: For versions 0.022 and earlier, update to version 0.023 to resolve the issue. As a temporary workaround, consider restricting access to the JWT.pm component or limiting network connectivity to minimize the risk of exploitation.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2019-1010161

Affected Products

Perl-Crypt-Jwt

References · 3

• https://osv.dev/vulnerability/CVE-2019-1010161 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010161 · Security Note
• https://github.com/DCIT/perl-Crypt-JWT/issues/3#issuecomment-417947483 · Note