65 matches found
json-jwt allows bypass of identity checks via a sign/encryption confusion attack
The json-jwt aka JSON::JWT gem versions 1.16.5 and below sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode...
Improper Verification of Cryptographic Signature
Overview json-jwt is a JSON Web Token and its family JSON Web Signature, JSON Web Encryption and JSON Web Key in Ruby. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to a sign/encryption confusion attack via the JSON::JWT.decode function...
CVE-2023-51774
The json-jwt aka JSON::JWT gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode...
CVE-2023-51774: Improper Access Control
The json-jwt aka JSON::JWT gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode...
CVE-2023-51774
The json-jwt aka JSON::JWT gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode...
CVE-2023-51774
The json-jwt (aka JSON::JWT) gem for Ruby, specifically versions 1.16.x before 1.16.6 and 1.15.x before 1.15.3.1 , contains a vulnerability allowing attackers to bypass identity checks via a sign/encryption confusion attack . For instance, JWE can be used to bypass JSON::JWT.decode. This vulnerab...
PT-2023-31892 · Json-Jwt · Json-Jwt
Name of the Vulnerable Software and Affected Versions: json-jwt aka JSON::JWT versions 1.15.x through 1.15.3.0 json-jwt aka JSON::JWT versions 1.16.x through 1.16.5 Description: The issue allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be us...
CVE-2023-51774
Removed by vendor...
CVE-2023-51774
The json-jwt aka JSON::JWT gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode...
CVE-2023-51774
The json-jwt aka JSON::JWT gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode...
SUSE CVE-2019-18848
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
Debian DLA-2390-1 : ruby-json-jwt security update
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string. Therefore, there was a need to explicitly specify the number of elements when splitting a JWE string. For Debian 9 stretch, this problem has been fixed in version 1.6.2-1+deb9u2. We recommend that...
Debian: Security Advisory (DLA-2390-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
DLA-2390-1 ruby-json-jwt - security update
Bulletin has no description...
JSON-jwt Gem lacked element count during splitting of JWE string
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
GHSA-CFF7-6H4Q-Q5PJ JSON-jwt Gem lacked element count during splitting of JWE string
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
json-jwt improper input validation due to lack of element count when splitting string
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
Denial Of Service (DoS)
json-jwt is vulnerable to denial of service. The lack of element counts during a JWE string splitting can lead to an application crash when more than expected number of elements exists in the JWE string. This vulnerability could potentially allow for the bypass of the signature validation...
