Nimbus JOSE+JWT missing overflow check

🗓️ 13 May 2022 01:30:32Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 22 Views

Nimbus JOSE+JWT missing overflow check allows HMAC bypass attack

Reporter	Title	Published	Views	Family All 17
IBM Security Bulletins	Security Bulletin: Three vulnerabilities in Nimbus JOSE+JWT affect IBM Spectrum Conductor	3 Jun 202008:30	–	ibm
IBM Security Bulletins	Security Bulletin: Public disclosed vulnerability from Nimbus-JOSE-JWT affects IBM Spectrum LSF	6 Mar 201905:15	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been identified in DB2 that affect the IBM Performance Management product	20 May 202014:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Nimbus-JOSE-JWT affect IBM Spectrum Symphony	17 Apr 202008:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Db2® Warehouse has released a fix in response to multiple vulnerabilities found in IBM Db2®	19 Apr 202116:53	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in IBM® DB2® shipped with IBM PureData System for Operational Analytics	29 Apr 202501:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilities	6 Mar 202616:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE)	24 Aug 202010:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in dependent libraries affect IBM® Db2® leading to denial of service or privilege escalation.	10 Mar 202121:20	–	ibm
CNVD	Nimbus JOSE+JWT Security Bypass Vulnerability	21 Aug 201700:00	–	cnvd

Vulners

Node

com.nimbusds nimbus-jose-jwtRange<4.39maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2017-12972
bitbucket	www.bitbucket.org/connect2id/nimbus-jose-jwt/commits/0d2bd649ea386539220d4facfe1f65eb1dadb86c
bitbucket	www.bitbucket.org/connect2id/nimbus-jose-jwt/issues/224/byte-to-bit-overflow-in-cbc
bitbucket	www.bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt
lists	www.lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E
github	www.github.com/advisories/GHSA-2qp9-wg27-9pcv

29 Jan 2023 05:03Current

4.9Medium risk

Vulners AI Score4.9

CVSS 25

CVSS 37.5

EPSS0.00157

nimbus jose+jwt integer-overflow check hmac bypass