CVEvulnerability

CVE-2017-12973

3.1 LOW Published 2017-08-20 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-08-20
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
3.1 LOW — CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-354

Description

Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackers to conduct a padding oracle attack.

Affected configurations

• connect2id nimbus jose\+jwt 1.0 • connect2id nimbus jose\+jwt 1.1 • connect2id nimbus jose\+jwt 1.2 • connect2id nimbus jose\+jwt 1.3 • connect2id nimbus jose\+jwt 1.4 • connect2id nimbus jose\+jwt 1.5 • connect2id nimbus jose\+jwt 1.6 • connect2id nimbus jose\+jwt 1.7 • connect2id nimbus jose\+jwt 1.8 • connect2id nimbus jose\+jwt 1.9 • connect2id nimbus jose\+jwt 1.9.1 • connect2id nimbus jose\+jwt 1.10 • connect2id nimbus jose\+jwt 1.11 • connect2id nimbus jose\+jwt 1.12 • connect2id nimbus jose\+jwt 2.0 • connect2id nimbus jose\+jwt 2.0.1 • connect2id nimbus jose\+jwt 2.1 • connect2id nimbus jose\+jwt 2.1.1 • connect2id nimbus jose\+jwt 2.2 • connect2id nimbus jose\+jwt 2.3 • connect2id nimbus jose\+jwt 2.4 • connect2id nimbus jose\+jwt 2.5 • connect2id nimbus jose\+jwt 2.6 • connect2id nimbus jose\+jwt 2.7 • connect2id nimbus jose\+jwt 2.8 • connect2id nimbus jose\+jwt 2.9 • connect2id nimbus jose\+jwt 2.10 • connect2id nimbus jose\+jwt 2.10.1 • connect2id nimbus jose\+jwt 2.11.0 • connect2id nimbus jose\+jwt 2.12.0 • connect2id nimbus jose\+jwt 2.13.0 • connect2id nimbus jose\+jwt 2.13.1 • connect2id nimbus jose\+jwt 2.14 • connect2id nimbus jose\+jwt 2.15 • connect2id nimbus jose\+jwt 2.15.1 • connect2id nimbus jose\+jwt 2.15.2 • connect2id nimbus jose\+jwt 2.16 • connect2id nimbus jose\+jwt 2.17 • connect2id nimbus jose\+jwt 2.17.1 • connect2id nimbus jose\+jwt 2.17.2 • connect2id nimbus jose\+jwt 2.18 • connect2id nimbus jose\+jwt 2.18.1 • connect2id nimbus jose\+jwt 2.18.2 • connect2id nimbus jose\+jwt 2.19 • connect2id nimbus jose\+jwt 2.19.1 • connect2id nimbus jose\+jwt 2.20 • connect2id nimbus jose\+jwt 2.21 • connect2id nimbus jose\+jwt 2.22 • connect2id nimbus jose\+jwt 2.22.1 • connect2id nimbus jose\+jwt 2.23 • connect2id nimbus jose\+jwt 2.24 • connect2id nimbus jose\+jwt 2.25 • connect2id nimbus jose\+jwt 2.26 • connect2id nimbus jose\+jwt 2.26.1 • connect2id nimbus jose\+jwt 3.0 • connect2id nimbus jose\+jwt 3.1 • connect2id nimbus jose\+jwt 3.1.1 • connect2id nimbus jose\+jwt 3.1.2 • connect2id nimbus jose\+jwt 3.2 • connect2id nimbus jose\+jwt 3.2.1 … and 67 more

Related

Weakness · CWE (1)

  • CWE-354 Improper Validation of Integrity Check Value weakness

References