Input validation

2017-08-2016:29:00

PRIOn knowledge base

www.prio-n.com

7.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.4%

JSON

Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows attackers to conduct an Invalid Curve Attack in environments where the JCE provider lacks the applicable curve validation.

CPENameOperatorVersion
nimbus_jose\\+jwteq1.9.1
nimbus_jose\\+jwteq4.0
nimbus_jose\\+jwteq2.6
nimbus_jose\\+jwteq1.4
nimbus_jose\\+jwteq4.3
nimbus_jose\\+jwteq2.1
nimbus_jose\\+jwteq2.16
nimbus_jose\\+jwteq2.19
nimbus_jose\\+jwteq2.10.1
nimbus_jose\\+jwteq4.34.2

Name	Operator	Version
nimbus_jose\\+jwt	eq	1.9.1
nimbus_jose\\+jwt	eq	4.0
nimbus_jose\\+jwt	eq	2.6
nimbus_jose\\+jwt	eq	1.4
nimbus_jose\\+jwt	eq	4.3
nimbus_jose\\+jwt	eq	2.1
nimbus_jose\\+jwt	eq	2.16
nimbus_jose\\+jwt	eq	2.19
nimbus_jose\\+jwt	eq	2.10.1
nimbus_jose\\+jwt	eq	4.34.2