PT-2024-40080 · Php-Jwt+4 · Php-Jwt+4

Published 2024-05-17 · Updated 2024-05-17

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: node-jsonwebtoken (affected versions not specified) pyjwt (affected versions not specified) namshi/jose (affected versions not specified) php-jwt (affected versions not specified) jsjwt (affected versions not specified)

Description: The issue affects several JSON Web Token (JWT) libraries, allowing attackers to bypass verification when using asymmetric keys such as RS256, RS384, RS512, ES256, ES384, and ES512.

Recommendations: For node-jsonwebtoken, update to a version that includes the fix for this issue. For pyjwt, update to a version that includes the fix for this issue. For namshi/jose, update to a version that includes the fix for this issue. For php-jwt, update to a version that includes the fix for this issue. For jsjwt, update to a version that includes the fix for this issue.

Related Identifiers

GHSA-4RR6-GF59-GGW5

Affected Products

Jsjwt

Namshi/Jose

Node-Jsonwebtoken

Php-Jwt

Pyjwt

References · 5

• https://osv.dev/vulnerability/GHSA-4rr6-gf59-ggw5 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/namshi/jose/2015-03-10.yaml · Note
• https://github.com/namshi/jose · Note
• https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries · Note
• https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries · Note