PT-2024-23734 · Jjwt · Jjwt

Published 2024-04-01 · Updated 2024-08-27 · CVE-2024-31033

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions JJWT (aka Java JWT) through 0.12.5

Description The issue concerns JJWT ignoring certain characters, potentially leading a user to falsely conclude they have a strong key. The impacted code includes the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class. However, the vendor disputes this issue, stating it cannot occur without user error and that the tested version must have been outdated.

Recommendations For JJWT through 0.12.5, consider reviewing the usage of the setSigningKey() and signWith() methods to ensure correct implementation and key strength assessment. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2024-31033

GHSA-R65J-6H5F-4F92

Affected Products

Jjwt

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-31033 · Security Note
• https://osv.dev/vulnerability/GHSA-r65j-6h5f-4f92 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-31033 · Vendor Advisory
• https://github.com/jwtk/jjwt/issues/930#issuecomment-2032699358 · Note
• https://github.com/jwtk/jjwt · Note
• https://github.com/jwtk/jjwt/blob/26948610fbef81eba867cbaad54b516d1874c70a/impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtParserBuilder.java#L242 · Note
• https://t.me/cvenotify/75278 · Telegram Post
• https://viralpatel.net/java-create-validate-jwt-token · Note
• https://t.me/cvenotify/75303 · Telegram Post
• ❌ https://github.com/2308652512/JJWT_BUG · Note, Deleted
• https://t.me/cvenotify/75589 · Telegram Post
• https://t.me/cvenotify/88406 · Telegram Post