Signature Verification Bypass

F21 JWT is vulnerable to signature verification bypasses. A malicious user can pass a malicious token to the application to bypass token signature verification...

Timing Attacks

Malcolm Fell jwt is vulnerable to timing attacks. The library does not compare hashes in constant time, which allows malicious users to use the timing of the request to progressively identify a valid hash...

CVE-2017-8034

The Cloud Controller and Router in Cloud Foundry CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267 do not validate the issuer on JSON Web Tokens JWTs from UAA. With certain multi-zone UAA configurations, zone administrators...

PT-2017-18079

Name of the Vulnerable Software and Affected Versions Cloud Foundry CAPI-release versions prior to v1.32.0 Cloud Foundry Routing-release versions prior to v0.159.0 Cloud Foundry CF-release versions prior to v267 Description The issue concerns the Cloud Controller and Router in Cloud Foundry, whic...

Code injection

A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted to progressively extract the scalar input to ScalarMult by...

CVE-2017-8932

A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted to progressively extract the scalar input to ScalarMult by...

CVE-2017-8932

A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted to progressively extract the scalar input to ScalarMult by...

UBUNTU-CVE-2017-8932

A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted to progressively extract the scalar input to ScalarMult by...

CVE-2017-8932

A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted to progressively extract the scalar input to ScalarMult by...

CVE-2017-8932

CVE-2017-8932 affects the Go standard library’s ScalarMult on the P-256 curve for amd64. The bug causes incorrect results for certain input points, enabling an adaptive attack that progressively extracts the scalar in the ScalarMult operation and can lead to a full key recovery for static ECDH as...

Input validation

An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.60, 1.7.x versions prior to 1.7.41, 1.8.x versions prior to 1.8.23, and 1.9.x versions prior to 1.9.1. Incomplete validation logic in JSON Web Token JWT libraries can allow unprivileged attackers to impersonate oth...

CVE-2016-8218

An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete validation logic in JSON Web Token JWT libraries can allow unprivileged attackers to impersonate other users to the routing API, aka an "Unauthenticated JWT...

CVE-2017-2773

An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.60, 1.7.x versions prior to 1.7.41, 1.8.x versions prior to 1.8.23, and 1.9.x versions prior to 1.9.1. Incomplete validation logic in JSON Web Token JWT libraries can allow unprivileged attackers to impersonate oth...

CVE-2017-2773

Affected product: Pivotal PCF Elastic Runtime. Issue: Incomplete validation logic in JSON Web Token (JWT) libraries can allow unprivileged attackers to impersonate other users across multiple PCF Elastic Runtime components. Affected versions include 1.6.x before 1.6.60, 1.7.x before 1.7.41, 1.8.x...

CVE-2016-8218

CVE-2016-8218 affects Cloud Foundry’s routing-release (versions prior to 0.142.0) and cf-release (203–231). The issue is incomplete validation in JSON Web Token (JWT) libraries, enabling unprivileged attackers to impersonate other users to the routing API. Remediation: upgrade routing-release to ...

CVE-2017-2773: Improper Input Validation

An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.60, 1.7.x versions prior to 1.7.41, 1.8.x versions prior to 1.8.23, and 1.9.x versions prior to 1.9.1. Incomplete validation logic in JSON Web Token JWT libraries can allow unprivileged attackers to impersonate oth...

PT-2017-9537

Name of the Vulnerable Software and Affected Versions Cloud Foundry Foundation routing-release versions prior to 0.142.0 Cloud Foundry Foundation cf-release versions 203 through 231 Description An issue exists due to incomplete validation logic in JSON Web Token JWT libraries, allowing unprivileg...

CVE-2016-8218: Improper Input Validation

An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete validation logic in JSON Web Token JWT libraries can allow unprivileged attackers to impersonate other users to the routing API, aka an "Unauthenticated JWT...

Timing Attack

github.com/dgrijalva/jwt-go is vulnerable to timing attacks. This vulnerability is caused because the hashes are not compared in constant time, allowing malicious users to guess the valid hashes are based on the time that a comparison takes...

PT-2017-4204

Name of the Vulnerable Software and Affected Versions Nimbus JOSE+JWT versions prior to 4.39 Description The issue is related to insufficient authentication data verification in the Nimbus JOSE+JWT library. This allows attackers to conduct HMAC bypass attacks by manipulating Additional...