jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC

🗓️ 22 Dec 2022 03:33:19Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 46 Views

jsonwebtoken's insecure key retrieval can lead to Forgeable Public/Private Token

Reporter	Title	Published	Views	Family All 29
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in jsonwebtoken package affects Data Replication on Cloud Pak for Data	7 Nov 202321:50	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in jsonwebtoken	3 Mar 202315:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to bypassing of security restrictions due to [CVE-2022-23539], [CVE-2022-23540] and [CVE-2022-23541]	28 Jun 202315:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Decision Optimization in IBM Cloud Pak for Data is vulnerable to jsonwebtoken CVEs	17 Feb 202307:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Information Queue has multiple third-party library vulnerabilities	16 May 202316:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	20 Jun 202416:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a remote attacker due to multiple jsonwebtoken CVEs	30 Jan 202310:40	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo Application Suite uses jsonwebtoken package which is vulnerable to CVE-2022-23541, CVE-2022-23539, CVE-2022-23529 and CVE-2022-23540	27 Mar 202320:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Json4j Affects Watson Machine Learning Accelerator	3 Mar 202320:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by a vulnerability in JSON Web Token	24 Feb 202313:19	–	ibm

Vulners

Node

auth0 jsonwebtokenRange≤8.5.1npm

Source	Link
github	www.github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
github	www.github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-23541
github	www.github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0
security	www.security.netapp.com/advisory/ntap-20240621-0007
github	www.github.com/advisories/GHSA-hjrf-2m68-5959

24 Jun 2024 21:24Current

1.9Low risk

Vulners AI Score1.9

CVSS 3.15 - 6.3

EPSS0.00753

SSVC

CWE-287 CWE-1259

jsonwebtoken security vulnerability key retrieval rsa hmac version 8.5.1 token validation asymmetric key symmetric key update no impact