PT-2019-7833 · Php · Php Jose Library

Published 2019-08-07 · Updated 2023-03-03 · CVE-2016-5431

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions PHP JOSE Library versions prior to 2.2.1

Description The issue allows for key confusion/algorithm substitution in the JWS component, resulting in the bypassing of signature verification via crafted tokens.

Recommendations For versions prior to 2.2.1, update to version 2.2.1 or later to resolve the issue.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2016-5431

GHSA-XM5F-HC9R-76F3

Affected Products

Php Jose Library

References · 5

• https://github.com/nov/jose-php/commit/1cce55e27adf0274193eb1cd74b927a398a3df4b · Patch
• https://osv.dev/vulnerability/CVE-2016-5431 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5431 · Security Note
• https://osv.dev/vulnerability/GHSA-xm5f-hc9r-76f3 · Vendor Advisory
• https://github.com/nov/jose-php · Note