com.nimbusds:c2id-server-sdk (>=2.0, <=2.0.3), com.nimbusds:oauth2-oidc-sdk (>=4.0, <=4.3) +1 more potentially affected by CVE-2017-12974 via com.nimbusds:nimbus-jose-jwt (3.1.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:c2id-server-sdk =2.0, =4.0, =1.2.10, =1.2.14 Source cves: CVE-2017-12974 Source advisory:...

co.cask:google-cloud (>=0.11.0, <=0.11.2), com.alibaba.alink:alink_connector_parquet_flink-1.10_2.11 (>=1.5.4, <=1.6.2) +359 more potentially affected by CVE-2017-12974 via com.nimbusds:nimbus-jose-jwt (3.9)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.9 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - co.cask:google-cloud =0.11.0, =1.5.4, =1.5.4, =1.5.4, =1.5.4, =1.5.4, =1.1.2, =1.1.2, =1.2.0 -...

org.mitre:openid-connect-client (>=1.0.12, <=1.1.0), org.mitre:openid-connect-common (>=1.0.12, <=1.1.0) +3 more potentially affected by CVE-2017-12974 via com.nimbusds:nimbus-jose-jwt (2.17.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =1.0.12, =1.0.12, =1.0.12, =1.0.12, =1.1.0 -...

com.bluefirereader:sso-user (>=1.0.0, <=1.2.13), com.intropro:b-test (>=1.0.2, <=1.0.10) +3 more potentially affected by CVE-2017-12974 via com.nimbusds:nimbus-jose-jwt (2.26)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.26 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.bluefirereader:sso-user =1.0.0, =1.0.2, =1.0.10 - com.nimbusds:oauth2-oidc-sdk 3.3 -...

com.nimbusds:oauth2-oidc-sdk (2.0) potentially affected by CVE-2017-12974 via com.nimbusds:nimbus-jose-jwt (2.15.0)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk 2.0 Source cves: CVE-2017-12974 Source advisory: OSV:GHSA-PFV2-37F7-9M6W...

de.yourinspiration:spring-jwt (>=0.0.1, <=0.1.0), eu.tarienna:spring-jwt (>=0.1.0, <=1.0.0) potentially affected by CVE-2017-12974 via com.nimbusds:nimbus-jose-jwt (2.10.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - de.yourinspiration:spring-jwt =0.0.1, =0.1.0, =1.0.0 Source cves: CVE-2017-12974 Source advisory:...

bio.ferlab:datalake-spark30_2.12 (0.2.39), bio.ferlab:datalake-spark31_2.12 (>=0.1.17, <=0.2.46) +96 more potentially affected by CVE-2017-12974 via com.nimbusds:nimbus-jose-jwt (3.1.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - bio.ferlab:datalake-spark302.12 0.2.39 - bio.ferlab:datalake-spark312.12 =0.1.17, =0.2.47, =0.9.0.0,...

com.nimbusds:oauth2-oidc-sdk (2.10) potentially affected by CVE-2017-12974 via com.nimbusds:nimbus-jose-jwt (2.18.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.18.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk 2.10 Source cves: CVE-2017-12974 Source advisory: OSV:GHSA-PFV2-37F7-9M6W...

com.nimbusds:oauth2-oidc-sdk (>=2.14, <=2.14.1) potentially affected by CVE-2017-12974 via com.nimbusds:nimbus-jose-jwt (2.22)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.22 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk =2.14, =2.14.1 Source cves: CVE-2017-12974 Source advisory:...

com.nimbusds:oauth2-oidc-sdk (>=4.6, <=4.7), com.nimbusds:oidc-session-store (1.2) potentially affected by CVE-2017-12974 via com.nimbusds:nimbus-jose-jwt (3.2.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.nimbusds:oauth2-oidc-sdk =4.6, =4.7 - com.nimbusds:oidc-session-store 1.2 Source cves: CVE-2017-129...

edu.uiuc.ncsa.myproxy:oa4mp-client-loader-oauth2 (>=3.0, <=3.2.1), edu.uiuc.ncsa.myproxy:oa4mp-client-oauth2 (>=3.0, <=3.2.1) +5 more potentially affected by CVE-2017-12974 via com.nimbusds:nimbus-jose-jwt (3.8)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - edu.uiuc.ncsa.myproxy:oa4mp-client-loader-oauth2 =3.0, =3.0, =3.0, =3.0, =3.0, =3.0, =3.0, =3.2.1 Source...

com.aliyun.hbase:alihbase-assembly (2.0.2), com.aliyun.hbase:alihbase-endpoint (2.0.2) +75 more potentially affected by CVE-2017-12974 via com.nimbusds:nimbus-jose-jwt (3.10)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.10 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.aliyun.hbase:alihbase-assembly 2.0.2 - com.aliyun.hbase:alihbase-endpoint 2.0.2 -...

Security Bulletin: Three vulnerabilities in Nimbus JOSE+JWT affect IBM Spectrum Conductor

Summary There are three vulnerabilities in Nimbus JOSE+JWT 3.1.2 used by IBM Spectrum Conductor 2.4.1, IBM Spectrum Conductor 2.4.0 and IBM Spectrum Conductor 2.3.0. IBM Spectrum Conductor 2.4.1, IBM Spectrum Conductor 2.4.0 and IBM Spectrum Conductor 2.3 have addressed the applicable CVEs...

Security Bulletin: Multiple vulnerabilities in Nimbus-JOSE-JWT affect IBM Spectrum Symphony

Summary Multiple vulnerabilities exist in the Nimbus-JOSE-JWT used by IBM Spectrum Symphony V7.3 and V7.2.1. Interim fixes that provide instructions on upgrading the nimbus-jose-jwt package to version 8.10 are available on IBM Fix Central. Vulnerability Details CVEID: CVE-2017-12974 DESCRIPTION:...

CVE-2017-12974

Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows attackers to conduct an Invalid Curve Attack in environments where the JCE provider lacks the applicable curve validation...

bio.ferlab:datalake-spark30_2.12 (0.2.39), bio.ferlab:datalake-spark31_2.12 (>=0.1.17, <=0.2.46) +823 more potentially affected by CVE-2017-12974 via com.nimbusds:nimbus-jose-jwt (>=2.10.1, <=4.35)

com.nimbusds:nimbus-jose-jwt MAVEN version =2.10.1, =0.1.17, =0.2.47, =0.11.0, =0.9.0.0, =0.9.0.0, =1.5.4, =1.5.4, =1.5.4, =1.5.4, =1.5.4, =1.1.2, =1.1.2, =1.2.0 - com.alibaba.alink:alinkcoreflink-1.102.11 1.2.0 and more Source cves: CVE-2017-12974 Source advisory: MEND:CVE-2017-12974...

CVE-2017-12974

CVE-2017-12974 is a confirmed Nimbus JOSE+JWT vulnerability where ECKey construction proceeds without validating that public x/y coordinates lie on the specified curve, enabling an Invalid Curve Attack in environments lacking curve validation. Connected documents confirm this issue across multipl...