GHSA-R65J-6H5F-4F92 Withdrawn: JJWT improperly generates signing keys

🗓️ 01 Apr 2024 03:30:38Reported by GoogleType

osv_ghsa🔗 osv.dev👁 32 Views

Withdrawn advisory: Java Web Token ignores some key characters, misleading key strength; affects setSigningKey and signWith.

Reporter	Title	Published	Views	Family All 17
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Service is affected by Java JWT vulnerability	9 Aug 202405:50	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities related to Angular and JJWT have been fixed in IBM Informix HQ 3.2.2.	27 Apr 202606:31	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found in IBM ApplinX.	7 Apr 202616:51	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Controller	4 Dec 202514:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses jjwt-impl-0.11.5.jar which is vulnerable to CVE-2024-31033	5 May 202612:50	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in jjwt may affect IBM Business Automation Workflow - CVE-2024-31033	4 Jun 202509:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in JWT	26 Feb 202518:46	–	ibm
Circl	CVE-2024-31033	31 Mar 202401:56	–	circl
CNNVD	Java JWT security vulnerabilities	1 Apr 202400:00	–	cnnvd
CVE	CVE-2024-31033	1 Apr 202400:00	–	cve

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-31033
github	www.github.com/jwtk/jjwt/issues/930
github	www.github.com/2308652512/JJWT_BUG
github	www.github.com/jwtk/jjwt
github	www.github.com/jwtk/jjwt/blob/26948610fbef81eba867cbaad54b516d1874c70a/impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtParserBuilder.java
viralpatel	www.viralpatel.net/java-create-validate-jwt-token

10 Sep 2026 03:50Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.8

EPSS0.00776