CVEvulnerability

CVE-2019-17195

9.8 CRITICAL Published 2019-10-15 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-10-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-755

Description

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.

Affected configurations

• connect2id nimbus jose\+jwt (< 7.9) • apache hadoop 3.2.1 • oracle communications cloud native core security edge protection proxy 1.7.0 • oracle communications pricing design center 12.0.0.3.0 • oracle data integrator 12.2.1.4.0 • oracle enterprise manager base platform 13.4.0.0 • oracle healthcare data repository 8.1.0 • oracle insurance policy administration (>= 11.0 <= 11.3.1) • oracle jd edwards enterpriseone orchestrator (<= 9.2.5.3) • oracle jd edwards enterpriseone tools (<= 9.2.5.3) • oracle peoplesoft enterprise peopletools 8.58 • oracle peoplesoft enterprise peopletools 8.59 • oracle policy automation (>= 12.2.0 <= 12.2.22) • oracle primavera gateway (>= 18.8.0 <= 18.8.11) • oracle primavera gateway 19.12.0 • oracle solaris cluster 4.0 • oracle weblogic server 12.2.1.3.0 • oracle weblogic server 12.2.1.4.0

Related

Weakness · CWE (1)

  • CWE-755 Improper Handling of Exceptional Conditions weakness

References