Forgeable Public/Private Tokens

Overview Affected versions of the jwt-simple package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use case of the JWT, the en...

Verification Bypass

Overview Versions 4.2.1 and earlier of jsonwebtoken are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT algorithm type, occuring when an attacker is allowed to arbitrarily specify the JWT algorithm. Recommendation Update to version 4.2.2 or later...

Fedora Update for python-jwt FEDORA-2015-10350

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Design/Logic Flaw

NAMSHI | JOSE 5.0.0 and earlier allows remote attackers to bypass signature verification via crafted tokens in a JSON Web Tokens JWT header...

CVE-2015-2964

CVE-2015-2964 affects namshi/jose (PHP JWT library). A vulnerability in processing JWT headers allows bypass of signature verification, enabling specially crafted tokens to be treated as valid data. Public sources indicate the library did not properly enforce signature checks (e.g., issues with t...

Fedora Update for python-jwt FEDORA-2015-10249

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 21 : python-jwt-1.3.0-1.fc21 (2015-10249)

Latest upstream with security fix for http://seclists.org/oss-sec/2015/q2/3 https://github.com/jpadilla/pyjwt/commit/88a9fc56bdc6c870aa6af93bda401 414a217db2a Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has...

Fedora 22 : python-jwt-1.3.0-1.fc22 (2015-10350)

Latest upstream with security fix for http://seclists.org/oss-sec/2015/q2/3 https://github.com/jpadilla/pyjwt/commit/88a9fc56bdc6c870aa6af93bda401 414a217db2a Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has...

JVN#25336719: namshi/jose fails to verify token signatures

namshi/jose is a PHP library for handling JSON Web Tokens JWT. namshi/jose contains a vulnerability in processing JWT headers where it fails to verify token signatures. Impact Specially crafted tokens may be validated as token data with valid signatures. Solution Update the Software Update to the...

CVE-2015-2951

JWT.php in F21 JWT before 2.0 allows remote attackers to bypass signature verification via crafted tokens...

CVE-2015-2951

The CVE-2015-2951 detail involves the F21 JWT PHP library (JWT.php) where versions before 2.0 fail to verify token signatures, enabling remote attackers to bypass signature verification via crafted tokens. Affected component is the PHP JWT token processor; root cause is signature verification byp...

CVE-2015-2951

JWT.php in F21 JWT before 2.0 allows remote attackers to bypass signature verification via crafted tokens...

JVN#06120222: F21 JWT fails to verify token signatures

JWT provided by F21 is a PHP library for handling JSON Web Tokens. JWT contains a vulnerability where it fails to verify token signatures. Impact Specially crafted tokens may be validated as token data with valid signatures. Solution Update the Software Update to the latest version according to t...