GitHub Advisoryadvisory · RubyGems

GHSA-mj4x-wcxf-hm8x Json-jwt did not verify the cryptographic signature for data

MEDIUM Published 2018-07-31 Modified 2023-08-25 Official page ↗
Aliases
CVE-2018-1000539
Ecosystem
RubyGems
Packages
json-jwt
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-347
Reviewed
2020-06-16

Affected packages

• RubyGems json-jwt: >= 0.5.1, < 1.9.4 → fixed in 1.9.4

Description

The json-jwt rubygem version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 1.9.4 and later.

Related

Alias · CVE (1)

  • CVE-2018-1000539 Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption… vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References