Json-jwt did not verify the cryptographic signature for data

2018-07-3118:13:51

Google

osv.dev

0.001 Low

EPSS

Percentile

41.0%

JSON

The json-jwt rubygem version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 1.9.4 and later.

CPENameOperatorVersion
json-jwteq1.1.0
json-jwteq0.7.0.alpha2
json-jwteq1.9.1
json-jwteq0.7.0
json-jwteq1.9.3
json-jwteq1.6.3
json-jwteq1.2.1
json-jwteq1.6.2
json-jwteq0.8.0
json-jwteq1.8.1.pre

Name	Operator	Version
json-jwt	eq	1.1.0
json-jwt	eq	0.7.0.alpha2
json-jwt	eq	1.9.1
json-jwt	eq	0.7.0
json-jwt	eq	1.9.3
json-jwt	eq	1.6.3
json-jwt	eq	1.2.1
json-jwt	eq	1.6.2
json-jwt	eq	0.8.0
json-jwt	eq	1.8.1.pre