PT-2020-14737 · Dp3T · Dp3T-Backend-Sdk

Mrsuicideparrot · Published 2020-07-30 · Updated 2020-08-05 · CVE-2020-15957

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions DP3T-Backend-SDK versions prior to 1.1.1

Description An issue was discovered in the DP3T-Backend-SDK. When configured to check JWT before uploading or publishing keys, it is possible to skip the signature check by providing a JWT token with alg=none.

Recommendations For versions prior to 1.1.1, update to version 1.1.1 or later to resolve the issue. As a temporary workaround, consider disabling the JWT check or restricting the use of the alg=none parameter until a patch is available.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2020-15957

GHSA-5M5Q-3QW2-3XF3

Affected Products

Dp3T-Backend-Sdk

References · 5

• https://github.com/DP-3T/dp3t-sdk-backend/security/advisories/GHSA-5m5q-3qw2-3xf3 · Patch
• https://osv.dev/vulnerability/CVE-2020-15957 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15957 · Security Note
• https://github.com/dp-3T/dp3t-sdk-backend · Note
• https://github.com/DP-3T/dp3t-sdk-backend/compare/v1.0.4...v1.1.0 · Note