PHP JOSE Library by Gree Inc. Uses a Broken or Risky Cryptographic Algorithm

2022-05-2416:52:44

Google

osv.dev

0.001 Low

EPSS

Percentile

36.1%

JSON

The PHP JOSE Library by Gree Inc. prior to 2.2.1 is vulnerable to key confusion/algorithm substitution in the JWS component resulting in bypassing the signature verification via crafted tokens.

CPENameOperatorVersion
gree/joseeq0.1.4
gree/joseeq0.1.3
gree/joseeq2.1.0
gree/joseeq2.0.1
gree/joseeq1.0.0
gree/joseeq0.1.0
gree/joseeq0.1.5
gree/joseeq2.2.0
gree/joseeq2.0.0
gree/joseeq0.1.1

Name	Operator	Version
gree/jose	eq	0.1.4
gree/jose	eq	0.1.3
gree/jose	eq	2.1.0
gree/jose	eq	2.0.1
gree/jose	eq	1.0.0
gree/jose	eq	0.1.0
gree/jose	eq	0.1.5
gree/jose	eq	2.2.0
gree/jose	eq	2.0.0
gree/jose	eq	0.1.1