CVEvulnerability

CVE-2017-12974

7.5 HIGH Published 2017-08-20 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-08-20
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-347

Description

Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows attackers to conduct an Invalid Curve Attack in environments where the JCE provider lacks the applicable curve validation.

Affected configurations

• connect2id nimbus jose\+jwt 1.0 • connect2id nimbus jose\+jwt 1.1 • connect2id nimbus jose\+jwt 1.2 • connect2id nimbus jose\+jwt 1.3 • connect2id nimbus jose\+jwt 1.4 • connect2id nimbus jose\+jwt 1.5 • connect2id nimbus jose\+jwt 1.6 • connect2id nimbus jose\+jwt 1.7 • connect2id nimbus jose\+jwt 1.8 • connect2id nimbus jose\+jwt 1.9 • connect2id nimbus jose\+jwt 1.9.1 • connect2id nimbus jose\+jwt 1.10 • connect2id nimbus jose\+jwt 1.11 • connect2id nimbus jose\+jwt 1.12 • connect2id nimbus jose\+jwt 2.0 • connect2id nimbus jose\+jwt 2.0.1 • connect2id nimbus jose\+jwt 2.1 • connect2id nimbus jose\+jwt 2.1.1 • connect2id nimbus jose\+jwt 2.2 • connect2id nimbus jose\+jwt 2.3 • connect2id nimbus jose\+jwt 2.4 • connect2id nimbus jose\+jwt 2.5 • connect2id nimbus jose\+jwt 2.6 • connect2id nimbus jose\+jwt 2.7 • connect2id nimbus jose\+jwt 2.8 • connect2id nimbus jose\+jwt 2.9 • connect2id nimbus jose\+jwt 2.10 • connect2id nimbus jose\+jwt 2.10.1 • connect2id nimbus jose\+jwt 2.11.0 • connect2id nimbus jose\+jwt 2.12.0 • connect2id nimbus jose\+jwt 2.13.0 • connect2id nimbus jose\+jwt 2.13.1 • connect2id nimbus jose\+jwt 2.14 • connect2id nimbus jose\+jwt 2.15 • connect2id nimbus jose\+jwt 2.15.1 • connect2id nimbus jose\+jwt 2.15.2 • connect2id nimbus jose\+jwt 2.16 • connect2id nimbus jose\+jwt 2.17 • connect2id nimbus jose\+jwt 2.17.1 • connect2id nimbus jose\+jwt 2.17.2 • connect2id nimbus jose\+jwt 2.18 • connect2id nimbus jose\+jwt 2.18.1 • connect2id nimbus jose\+jwt 2.18.2 • connect2id nimbus jose\+jwt 2.19 • connect2id nimbus jose\+jwt 2.19.1 • connect2id nimbus jose\+jwt 2.20 • connect2id nimbus jose\+jwt 2.21 • connect2id nimbus jose\+jwt 2.22 • connect2id nimbus jose\+jwt 2.22.1 • connect2id nimbus jose\+jwt 2.23 • connect2id nimbus jose\+jwt 2.24 • connect2id nimbus jose\+jwt 2.25 • connect2id nimbus jose\+jwt 2.26 • connect2id nimbus jose\+jwt 2.26.1 • connect2id nimbus jose\+jwt 3.0 • connect2id nimbus jose\+jwt 3.1 • connect2id nimbus jose\+jwt 3.1.1 • connect2id nimbus jose\+jwt 3.1.2 • connect2id nimbus jose\+jwt 3.2 • connect2id nimbus jose\+jwt 3.2.1 … and 63 more

Related

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References