CVEvulnerability
CVE-2017-16007
5.9 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2018-06-04
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 5.9 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 is vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) is used.
Affected configurations
• cisco node-jose (< 0.9.3)
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://blog.intothesymmetry.com/2017/03/critical-vulnerability-in-json-web.html Exploit, Third Party Advisory
- https://gist.github.com/asanso/fa25685348051ef6a28d49aa0f27a4ae Patch, Third Party Advisory
- https://github.com/cisco/node-jose Third Party Advisory
- https://nodesecurity.io/advisories/324 Third Party Advisory
- http://blog.intothesymmetry.com/2017/03/critical-vulnerability-in-json-web.html Exploit, Third Party Advisory
- https://gist.github.com/asanso/fa25685348051ef6a28d49aa0f27a4ae Patch, Third Party Advisory
- https://github.com/cisco/node-jose Third Party Advisory
- https://nodesecurity.io/advisories/324 Third Party Advisory