PT-2021-19818 · Common · Common

Oliver-Jung · Published 2021-07-26 · Updated 2021-08-13 · CVE-2021-32631

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Common versions prior to commit 3b96cb0293d3443b870351945f41d7d55cb34b53

Description The issue is related to the improper verification of the signature of JSON Web Tokens (JWTs) in the Common package. This allows an attacker to forge a valid JWT, potentially leading to authentication bypasses.

Recommendations For versions prior to commit 3b96cb0293d3443b870351945f41d7d55cb34b53, update to a version that includes the patch, specifically commit 3b96cb0293d3443b870351945f41d7d55cb34b53. As a temporary workaround, consider using the parseClaimsJws method to correctly verify the signature of a JWT until the patch is applied.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2021-32631

GHSA-FJQ8-896W-PV28

Affected Products

Common

References · 7

• https://github.com/nimble-platform/common/commit/12197a755bd524559bf4e16475595a2c6fcd34db · Patch
• https://github.com/nimble-platform/common/commit/3b96cb0293d3443b870351945f41d7d55cb34b53 · Patch
• https://github.com/nimble-platform/common/commit/a59ad46733912a5580530e39cac0e6ebc83cc563 · Patch
• https://osv.dev/vulnerability/CVE-2021-32631 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32631 · Security Note
• https://github.com/nimble-platform/common/security/advisories/GHSA-fjq8-896w-pv28 · Note
• https://t.me/cibsecurity/26498 · Telegram Post