PT-2024-40338 · Unknown · Namshi/Jose

Published 2024-05-17 · Updated 2024-05-17

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions namshi/jose (affected versions not specified)

Description The issue arises from the allowUnsecure flag, which permits tokens signed with 'none' algorithms to be processed when set to true. This behavior poses a significant security risk as it could allow an attacker to impersonate users by crafting a valid JWT token.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-HXHC-WMG8-XRQF

Affected Products

Namshi/Jose

References · 4

• https://osv.dev/vulnerability/GHSA-hxhc-wmg8-xrqf · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/namshi/jose/2015-02-19.yaml · Note
• https://github.com/namshi/jose · Note
• https://github.com/namshi/jose/commit/009f86d6ced000b806b2f602c0b7393060ebb34e · Note