PT-2024-40312 · Packagist+3 · Php-Jwt+4

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions node-jsonwebtoken (affected versions not specified) pyjwt (affected versions not specified) namshi/jose (affected versions not specified) php-jwt (affected versions not specified) jsjwt (affected versions not specified)

Description The issue affects several JSON Web Token (JWT) libraries, allowing attackers to bypass the verification step when using asymmetric keys, such as RS256, RS384, RS512, ES256, ES384, and ES512.

Recommendations For node-jsonwebtoken, update to a version that includes the fix for this issue. For pyjwt, update to a version that includes the fix for this issue. For namshi/jose, update to a version that includes the fix for this issue. For php-jwt, update to a version that includes the fix for this issue. For jsjwt, update to a version that includes the fix for this issue.

Related Identifiers

GHSA-H533-5V22-8VCP

Affected Products

Jsjwt

Namshi/Jose

Node-Jsonwebtoken

Php-Jwt

Pyjwt

References · 6

• https://osv.dev/vulnerability/GHSA-h533-5v22-8vcp · Vendor Advisory
• https://github.com/firebase/php-jwt · Note
• https://github.com/firebase/php-jwt/commit/b2c2be6a45fda769c8c2ffe5ec4259a9d1e46e5b · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/firebase/php-jwt/2015-04-02.yaml · Note
• https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries · Note
• https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries · Note