GitHub Advisoryadvisory · NuGet

GHSA-v5rv-hpxg-8x49 Signature validation bypass in ServiceStack

MEDIUM Published 2021-01-13 Modified 2021-01-13 Official page ↗
Aliases
CVE-2020-28042
Ecosystem
NuGet
Packages
ServiceStack
Severity
Moderate
Weaknesses
CWE-347
Reviewed
2021-01-13

Affected packages

• NuGet ServiceStack: < 5.9.2 → fixed in 5.9.2

Description

ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature.

Related

Alias · CVE (1)

  • CVE-2020-28042 ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes… vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References