47 matches found
EUVD-2026-16899
LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the...
CVE-2026-33996
LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the...
CVE-2026-33996
LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the...
CVE-2026-33996
LibJWT (C, the JSON Web Token library) versions prior to 3.3.0 are affected by a NULL value handling bug in JWK parsing for RSA-PSS. In 3.0.0–3.2.x, the parser could misinterpret integers where strings were expected, potentially enabling malformed JWKs to affect parsing. The issue was fixed in 3....
CVE-2026-33996 LibJWT has NULL/bounds validation in JWK octet and RSA PSS parsing
LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the...
PT-2026-28589
Name of the Vulnerable Software and Affected Versions LibJWT versions 3.0.0 through 3.2.9 Description LibJWT, a C JSON Web Token Library, has an issue in the RSA-PSS JWK parsing functionality. Versions prior to 3.3.0 do not adequately validate JSON string values, specifically failing to protect...
libjwt 代码问题漏洞
LibJWT is a C-language library developed by Ben Collins, designed for generating and verifying JSON Web Tokens. Versions of LibJWT from 3.0.0 to 3.3.0 contained code vulnerabilities. These vulnerabilities stemmed from RSA-PSS’s JWK parsing mechanism, which did not properly handle empty values,...
CVE-2026-33996: NULL Pointer Dereference
LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the...
Linux Distros Unpatched Vulnerability : CVE-2024-25189
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libjwt 1.15.3 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...
Debian dla-3739 : libjwt-dev - security update
The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3739 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3739-1 [email protected] https://www.debian.org/lts/security/...
Debian: Security Advisory (DLA-3739-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DLA 3739-1] libjwt security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-3739-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz February 24, 2024 https://wiki.debian.org/LTS -...
DLA-3739-1 libjwt - security update
Bulletin has no description...
Authentication Bypass
Overview Affected versions of this package are vulnerable to Authentication Bypass due to the insecure use of strcmp. Remediation There is no fixed version for libjwt. References - Report - Vulnerable Code Credit: P3ngu1nW...
CVE-2024-25189
libjwt 1.15.3 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...
DEBIAN-CVE-2024-25189
libjwt 1.15.3 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...
CVE-2024-25189
libjwt 1.15.3 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...
Authentication flaw
libjwt 1.15.3 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...
UBUNTU-CVE-2024-25189
libjwt 1.15.3 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...
PT-2024-20804
Name of the Vulnerable Software and Affected Versions libjwt version 1.15.3 Description The issue arises from the use of strcmp to verify authentication, which is not a constant time operation. This makes it easier for attackers to bypass authentication via a timing side channel. Recommendations...