CVE-2016-8218: Improper Input Validation

An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete validation logic in JSON Web Token JWT libraries can allow unprivileged attackers to impersonate other users to the routing API, aka an "Unauthenticated JWT...

CVE-2017-2773: Improper Input Validation

An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.60, 1.7.x versions prior to 1.7.41, 1.8.x versions prior to 1.8.23, and 1.9.x versions prior to 1.9.1. Incomplete validation logic in JSON Web Token JWT libraries can allow unprivileged attackers to impersonate oth...

PT-2017-9537

Name of the Vulnerable Software and Affected Versions Cloud Foundry Foundation routing-release versions prior to 0.142.0 Cloud Foundry Foundation cf-release versions 203 through 231 Description An issue exists due to incomplete validation logic in JSON Web Token JWT libraries, allowing unprivileg...

Timing Attack

github.com/dgrijalva/jwt-go is vulnerable to timing attacks. This vulnerability is caused because the hashes are not compared in constant time, allowing malicious users to guess the valid hashes are based on the time that a comparison takes...

PT-2017-4230

Name of the Vulnerable Software and Affected Versions Nimbus JOSE+JWT versions prior to 4.39 Description The issue is related to the improper handling of an invalid HMAC in authenticated AES-CBC decryption, allowing attackers to conduct a padding oracle attack. This is due to a lack of integrity...

PT-2017-4203

Name of the Vulnerable Software and Affected Versions Nimbus JOSE+JWT versions prior to 4.36 Description The issue concerns a problem with the construction of ECKey without proper validation of the public x and y coordinates on the specified curve, allowing for an Invalid Curve Attack in certain...

PT-2017-4204

Name of the Vulnerable Software and Affected Versions Nimbus JOSE+JWT versions prior to 4.39 Description The issue is related to insufficient authentication data verification in the Nimbus JOSE+JWT library. This allows attackers to conduct HMAC bypass attacks by manipulating Additional...

atlassian-jwt-auth (1.0.9) potentially affected by CVE-2016-9243 via cryptography (0.9.1)

cryptography PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 1.0.9 Source cves: CVE-2016-9243 Source advisory: OSV:PYSEC-2017-8...

atlassian-jwt-auth (>=2.0.0, <=2.8.0), cloudmesh-client (>=4.2.6, <=4.4.0) +43 more potentially affected by CVE-2016-9243 via cryptography (>=1.0.2, <=1.5.2)

cryptography PYPI version =1.0.2, =2.0.0, =4.2.6, =0.9.5, =0.0.1, =0.0.1, =1.1.1, =1.0.2, =1.0.2, =1.0.2, =0.0.1, =0.0.1, =1.0.2, =1.0.2, =1.0.3 and more Source cves: CVE-2016-9243 Source advisory: OSV:PYSEC-2017-8...

Invalid Curve Attack

node-jose, nimbus-jose-jwt and jose4j are vulnerable to invalid curve attacks. These attacks are possible when using key agreement with Elliptic Curve Diffie-Hellman Ephemeral Static ECDH-ES, allowing attackers to recover the private secret key...

CVE-2016-7037

The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function for hash comparison, which allows attackers to spoof signatures via a timing attack...

CVE-2016-7037

The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function for hash comparison, which allows attackers to spoof signatures via a timing attack...

Design/Logic Flaw

The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function for hash comparison, which allows attackers to spoof signatures via a timing attack...

CVE-2016-7037

The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function for hash comparison, which allows attackers to spoof signatures via a timing attack...

CVE-2016-7037

The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function for hash comparison, which allows attackers to spoof signatures via a timing attack...

CVE-2016-7037

The CVE concerns Malcolm Fell jwt (before 1.0.3). The verify function in Encryption/Symmetric.php does not use a timing-safe hash comparison, allowing an attacker to spoof signatures via timing attacks. Impact is signature forgery; remediation is upgrading to version 1.0.3 or later (as per refere...

PT-2017-9075

Name of the Vulnerable Software and Affected Versions jwt versions prior to 1.0.3 Description The issue concerns a timing attack that can be used to spoof signatures. This is due to the verify function in Encryption/Symmetric.php not utilizing a timing-safe function for hash comparison, allowing...

CVE-2016-7037: Undefined Security Weakness

The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function for hash comparison, which allows attackers to spoof signatures via a timing attack...

Denial Of Service (DoS)

json-jwt is vulnerable to denial of service DoS attacks. A malicious attacker can cause a denial of service when decoding the jwt-json signatures. This is unsafe because the tokens are stored as symbols that allocates memory to a string but is not removed by the garbage collection after being use...

Timing Attack

json-jwt is vulnerable to timing attacks. The library is vulnerable because they do not compare signatures in constant-time, which allows malicious users to use the timing of the request to progressively identify a valid signatures...