Lucene search

GitHub Advisory DatabaseGHSA-XM5F-HC9R-76F3

HistoryMay 24, 2022 - 4:52 p.m.

PHP JOSE Library by Gree Inc. Uses a Broken or Risky Cryptographic Algorithm

2022-05-2416:52:44

CWE-327

GitHub Advisory Database

github.com

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

36.1%

JSON

The PHP JOSE Library by Gree Inc. prior to 2.2.1 is vulnerable to key confusion/algorithm substitution in the JWS component resulting in bypassing the signature verification via crafted tokens.

Affected configurations

Vulners

Node

greegree\+Range<2.2.1android

CPENameOperatorVersion
gree/joselt2.2.1

CPE	Name	Operator	Version
	gree/jose	lt	2.2.1

References

github.com/advisories/GHSA-xm5f-hc9r-76f3

github.com/nov/jose-php/commit/1cce55e27adf0274193eb1cd74b927a398a3df4b

nvd.nist.gov/vuln/detail/CVE-2016-5431

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

36.1%

JSON

Related for GHSA-XM5F-HC9R-76F3