Design/Logic Flaw

2017-08-2016:29:00

PRIOn knowledge base

www.prio-n.com

4.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.0%

JSON

Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackers to conduct a padding oracle attack.

CPENameOperatorVersion
nimbus_jose\\+jwteq1.9.1
nimbus_jose\\+jwteq4.0
nimbus_jose\\+jwteq2.6
nimbus_jose\\+jwteq1.4
nimbus_jose\\+jwteq4.3
nimbus_jose\\+jwteq2.1
nimbus_jose\\+jwteq2.16
nimbus_jose\\+jwteq2.19
nimbus_jose\\+jwteq2.10.1
nimbus_jose\\+jwteq4.34.2

Name	Operator	Version
nimbus_jose\\+jwt	eq	1.9.1
nimbus_jose\\+jwt	eq	4.0
nimbus_jose\\+jwt	eq	2.6
nimbus_jose\\+jwt	eq	1.4
nimbus_jose\\+jwt	eq	4.3
nimbus_jose\\+jwt	eq	2.1
nimbus_jose\\+jwt	eq	2.16
nimbus_jose\\+jwt	eq	2.19
nimbus_jose\\+jwt	eq	2.10.1
nimbus_jose\\+jwt	eq	4.34.2