CVE-2017-12973

Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackers to conduct a padding oracle attack...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM® DB2® shipped with IBM PureData System for Operational Analytics

Summary IBM® DB2® is shipped as a component of IBM PureData System for Operational Analytics. Information about security vulnerabilities affecting IBM DB2 have been published in a security bulletin. Vulnerability Details CVEID:CVE-2017-12973 DESCRIPTION: Connect2id Nimbus JOSE+JWT could provide...

de.yourinspiration:spring-jwt (>=0.0.1, <=0.1.0), eu.tarienna:spring-jwt (>=0.1.0, <=1.0.0) potentially affected by CVE-2017-12973 via com.nimbusds:nimbus-jose-jwt (2.10.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - de.yourinspiration:spring-jwt =0.0.1, =0.1.0, =1.0.0 Source cves: CVE-2017-12973 Source advisory:...

org.mitre:openid-connect-client (>=0.9.2, <=1.0.0), org.mitre:openid-connect-common (>=0.9.2, <=1.0.0) +2 more potentially affected by CVE-2017-12973 via com.nimbusds:nimbus-jose-jwt (2.13.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =0.9.2, =0.9.2, =0.9.2, =0.9.2, =1.0.0 Source cves: CVE-2017-12973...

com.nimbusds:oauth2-oidc-sdk (>=2.1, <=2.8), com.nimbusds:oidc-userinfo-ldap (1.0) +1 more potentially affected by CVE-2017-12973 via com.nimbusds:nimbus-jose-jwt (2.16)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.16 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk =2.1, =2.8 - com.nimbusds:oidc-userinfo-ldap 1.0 -...

com.nimbusds:oauth2-oidc-sdk (2.10) potentially affected by CVE-2017-12973 via com.nimbusds:nimbus-jose-jwt (2.18.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.18.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk 2.10 Source cves: CVE-2017-12973 Source advisory: OSV:GHSA-JFMQ-4G4M-99RH...

com.nimbusds:oauth2-oidc-sdk (>=2.14, <=2.14.1) potentially affected by CVE-2017-12973 via com.nimbusds:nimbus-jose-jwt (2.22)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.22 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk =2.14, =2.14.1 Source cves: CVE-2017-12973 Source advisory:...

com.bluefirereader:sso-user (>=1.0.0, <=1.2.13), com.intropro:b-test (>=1.0.2, <=1.0.10) +3 more potentially affected by CVE-2017-12973 via com.nimbusds:nimbus-jose-jwt (2.26)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.26 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.bluefirereader:sso-user =1.0.0, =1.0.2, =1.0.10 - com.nimbusds:oauth2-oidc-sdk 3.3 -...

com.nimbusds:oauth2-oidc-sdk (4.8), com.nimbusds:oidc-session-store (>=1.2.2, <=1.3.1) potentially affected by CVE-2017-12973 via com.nimbusds:nimbus-jose-jwt (3.4)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk 4.8 - com.nimbusds:oidc-session-store =1.2.2, =1.3.1 Source cves:...

com.github.kikuomax:spray-jwt-shapeless2_2.10 (>=0.0.1, <=0.0.3), com.github.kikuomax:spray-jwt-shapeless2_2.11 (>=0.0.1, <=0.0.3) +3 more potentially affected by CVE-2017-12973 via com.nimbusds:nimbus-jose-jwt (3.5)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.github.kikuomax:spray-jwt-shapeless22.10 =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.3 -...

edu.uiuc.ncsa.myproxy:oa4mp-client-loader-oauth2 (>=3.0, <=3.2.1), edu.uiuc.ncsa.myproxy:oa4mp-client-oauth2 (>=3.0, <=3.2.1) +5 more potentially affected by CVE-2017-12973 via com.nimbusds:nimbus-jose-jwt (3.8)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - edu.uiuc.ncsa.myproxy:oa4mp-client-loader-oauth2 =3.0, =3.0, =3.0, =3.0, =3.0, =3.0, =3.0, =3.2.1 Source...

com.aliyun.hbase:alihbase-assembly (2.0.2), com.aliyun.hbase:alihbase-endpoint (2.0.2) +75 more potentially affected by CVE-2017-12973 via com.nimbusds:nimbus-jose-jwt (3.10)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.10 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.aliyun.hbase:alihbase-assembly 2.0.2 - com.aliyun.hbase:alihbase-endpoint 2.0.2 -...

com.atlassian.asap:asap-client-core (>=2.11.0, <=2.14.2), com.atlassian.asap:asap-client-feign (>=2.11.0, <=2.14.2) +367 more potentially affected by CVE-2017-12973 via com.nimbusds:nimbus-jose-jwt (>=4.0, <=4.37.1)

com.nimbusds:nimbus-jose-jwt MAVEN version =4.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.14.2 and more Source cves: CVE-2017-12973 Source advisory: OSV:GHSA-JFMQ-4G4M-99RH...

com.atlassian.asap:asap-client-core (>=2.11.0, <=2.14.2), com.atlassian.asap:asap-client-feign (>=2.11.0, <=2.14.2) +367 more potentially affected by CVE-2017-12973 via com.nimbusds:nimbus-jose-jwt (>=4.0, <=4.37.1)

com.nimbusds:nimbus-jose-jwt MAVEN version =4.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.14.2 and more Source cves: CVE-2017-12973 Source advisory: GHSA-JFMQ-4G4M-99RH...

Security Bulletin: IBM Db2® Warehouse has released a fix in response to multiple vulnerabilities found in IBM Db2®

Summary IBM has released the following fix for IBM Db2® Warehouse in response to multiple vulnerabilities found in IBM Db2®. Vulnerability Details CVEID: CVE-2020-4230 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 11.1 and 11.5 is vulnerable to an escalation of...

CVE-2017-12973

Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackers to conduct a padding oracle attack...

CVE-2017-12973

Nimbus JOSE+JWT prior to 4.39 proceeds after detecting an invalid HMAC in authenticated AES-CBC decryption, enabling a padding oracle attack. Affected: Nimbus JOSE+JWT library (Connect2id). Risk: padding oracle could leak data or enable exploitation. Remediation: upgrade to version 4.39 or later ...