The vulnerability of the Nimbus JOSE + JWT Java library, related to incorrect verification of the cryptographic signature, allows a perpetrator to influence the integrity of the information.

🗓️ 02 Aug 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Nimbus JOSE JWT Java library has a flaw in signature verification that could tamper with data integrity.

Reporter	Title	Published	Views	Family All 17
IBM Security Bulletins	Security Bulletin: Three vulnerabilities in Nimbus JOSE+JWT affect IBM Spectrum Conductor	3 Jun 202008:30	–	ibm
IBM Security Bulletins	Security Bulletin: Public disclosed vulnerability from Nimbus-JOSE-JWT affects IBM Spectrum LSF	6 Mar 201905:15	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been identified in DB2 that affect the IBM Performance Management product	20 May 202014:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Nimbus-JOSE-JWT affect IBM Spectrum Symphony	17 Apr 202008:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Db2® Warehouse has released a fix in response to multiple vulnerabilities found in IBM Db2®	19 Apr 202116:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilities	6 Mar 202616:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE)	24 Aug 202010:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in dependent libraries affect IBM® Db2® leading to denial of service or privilege escalation.	10 Mar 202121:20	–	ibm
CNVD	Nimbus JOSE+JWT Invalid Curve Attack Information Disclosure Vulnerability	21 Aug 201700:00	–	cnvd
CVE	CVE-2017-12974	20 Aug 201716:00	–	cve

Vulners

Node

connect2id nimbus_jose_+_jwtRange<4.36

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2017-12974
vuldb	www.vuldb.com/
bitbucket	www.bitbucket.org/connect2id/nimbus-jose-jwt/commits/f3a7a801f0c6b078899fed9226368eb7b44e2b2f
bitbucket	www.bitbucket.org/connect2id/nimbus-jose-jwt/issues/217/explicit-check-for-ec-public-key-on-curve
bitbucket	www.bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt
lists	www.lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E
web	www.web.nvd.nist.gov/view/vuln/detail

02 Aug 2022 00:00Current

CVSS 37.5

CVSS 27.8

EPSS0.00141

Nimbus JOSE JWT signature verification data integrity java library vulnerability