Design/Logic Flaw

HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."...

CVE-2021-41803

Removed by vendor...

CVE-2021-41803

HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."...

CVE-2021-41803

HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."...

HashiCorp Consul 安全漏洞

HashiCorp Consul is a suite of distributed, highly available data center-aware solutions from HashiCorp USA. The product is used to connect and configure applications across dynamically distributed infrastructures. A security vulnerability exists in HashiCorp Consul versions 1.8.1, 1.11.81.12.4,...

CVE-2021-41803

HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."...

CVE-2021-41803

CVE-2021-41803 affects HashiCorp Consul 1.8.1–1.11.8, 1.12.4, and 1.13.1; root cause is improper validation of node/segment names before interpolation and usage in JWT claim assertions via auto config RPC. Consequences and exploitation details are not further described in the supplied documents. ...

CVE-2022-39227: Authentication Bypass by Spoofing

python-jwt is a module for generating and verifying JSON Web Tokens. Versions prior to 3.3.4 are subject to Authentication Bypass by Spoofing, resulting in identity spoofing, session hijacking or authentication bypass. An attacker who obtains a JWT can arbitrarily forge its contents without knowi...

python-jwt 安全漏洞

python-jwt is a Python module for generating and verifying JSON web tokens from the individual developer David Halls. A security vulnerability exists in python-jwt versions prior to 3.3.4 that stems from being affected by spoofing to bypass authentication, which can lead to identity spoofing,...

CVE-2021-41803: Missing Authorization

HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."...

CVE-2021-41803

HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."...

CVE-2021-41803

HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."...

GHSA-5P8V-58QM-C7FP python-jwt vulnerable to token forgery with new claims

Impact An attacker who obtains a JWT can arbitrarily forge its contents without knowing the secret key. Depending on the application, this may for example enable the attacker to spoof other user's identities, hijack their sessions, or bypass authentication. Patches Users should upgrade to version...

python-jwt vulnerable to token forgery with new claims

Impact An attacker who obtains a JWT can arbitrarily forge its contents without knowing the secret key. Depending on the application, this may for example enable the attacker to spoof other user's identities, hijack their sessions, or bypass authentication. Patches Users should upgrade to version...

Authorization Bypass

jwcrypto is vulnerable to authorization bypass. The vulnerability is due to JWT auto-detecting the token type; under certain circumstances, it's possible to substitute a signed JWS token with a JWE token encrypted with the public key used for signature validation...

GHSA-GWP4-MCV4-W95J jwcrypto token substitution can lead to authentication bypass

The JWT code can auto-detect the type of token being provided, and this can lead the application to incorrect conclusions about the trustworthiness of the token. Quoting the private disclosure we received : "Under certain circumstances, it is possible to substitute a .. signed JWS with a JWE that...

jwcrypto token substitution can lead to authentication bypass

The JWT code can auto-detect the type of token being provided, and this can lead the application to incorrect conclusions about the trustworthiness of the token. Quoting the private disclosure we received : "Under certain circumstances, it is possible to substitute a .. signed JWS with a JWE that...

PT-2022-20464

Name of the Vulnerable Software and Affected Versions OSV affected versions not specified Description The issue concerns the JWT code's ability to auto-detect token types, potentially leading to incorrect conclusions about token trustworthiness. Under certain circumstances, an attacker can...

@dci-lint/cmd-api-server (>=0.3.0, <=0.4.0), @dci-lint/test-api-client (>=0.3.0, <=0.4.0) +46 more potentially affected by CVE-2022-36083 via jose (>=1.18.1, <=1.28.1)

jose NPM version =1.18.1, =0.3.0, =0.3.0, =0.3.0, =0.10.0-unstable.0042dcd, =0.6.1, =0.6.3, =0.6.3, =0.6.4, =0.6.3, =0.6.9, =0.6.1, =0.6.3, =0.6.3, =0.6.3, =0.6.5, =0.9.4 and more Source cves: CVE-2022-36083 Source advisory: OSV:GHSA-JV3G-J58F-9MQ9...

@decentralized-identity/ion-sdk (>=0.1.0, <=0.4.1), @tadashi/jwt (>=6.0.0, <=7.0.0) +21 more potentially affected by CVE-2022-36083 via jose (>=2.0.1, <=2.0.5)

jose NPM version =2.0.1, =0.1.0, =6.0.0, =3.0.4, =3.0.4, =3.0.5, =3.0.4, =3.0.5, =3.0.4, =3.0.6, =3.0.3, =3.0.5, =3.1.0, =2.3.2, =0.1.0, =1.2.4 and more Source cves: CVE-2022-36083 Source advisory: OSV:GHSA-JV3G-J58F-9MQ9...