PT-2022-12914 · Firebase+1 · Firebase Php-Jwt+1

Paragonie-Security · Published 2022-03-29 · Updated 2024-04-04 · CVE-2021-46743

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Firebase PHP-JWT versions prior to 6.0.0

Description The issue is related to an algorithm-confusion problem, where an attacker can forge tokens that validate under the incorrect key when multiple types of keys are loaded in a key ring. This occurs via the kid (Key ID) header.

Recommendations For versions prior to 6.0.0, update to version 6.0.0 or later to resolve the issue.

Exploit

Fix

Type Confusion

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-843

CWE-347

Related Identifiers

ALT-PU-2023-1879

ALT-PU-2024-4537

ALT-PU-2024-4547

ALT-PU-2024-4961

CVE-2021-46743

GHSA-8XF4-W7QW-PJJW

Affected Products

Alt Linux

Firebase Php-Jwt

References · 7

• 🔥 https://github.com/firebase/php-jwt/issues/351 · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/firebase/php-jwt/CVE-2021-46743.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-46743 · Security Note
• https://osv.dev/vulnerability/GHSA-8xf4-w7qw-pjjw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-46743 · Vendor Advisory
• https://github.com/firebase/php-jwt · Note
• https://github.com/firebase/php-jwt/releases/tag/v6.0.0 · Note