Lucene search

[email protected]CVE-2017-16007

HistoryJun 04, 2018 - 7:29 p.m.

CVE-2017-16007

2018-06-0419:29:00

CWE-200

[email protected]

web.nvd.nist.gov

node-jose

javascript

json

jose

web browsers

node.js

security

vulnerability

nvd

ecdh-es

cve-2017-16007

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

5.8 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.9%

JSON

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 is vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) is used.

Affected configurations

NVD

Node

cisconode-joseRange<0.9.3node.js

CPENameOperatorVersion
cisco:node-josecisco node-joselt0.9.3

CPE	Name	Operator	Version
cisco:node-jose	cisco node-jose	lt	0.9.3

CNA Affected

[
  {
    "product": "node-jose node module",
    "vendor": "HackerOne",
    "versions": [
      {
        "status": "affected",
        "version": "<0.9.3"
      }
    ]
  }
]