2016 matches found
jwt security bypass vulnerability
jwt is an implementation of the JSON Web Token JWT scheme for use in PHP . A security bypass vulnerability exists in the verify function of the Encryption/Symmetric.php file in jwt 1.0.2 and earlier versions. An attacker can exploit this vulnerability to forge a signature...
CVE-2016-8218: Unauthenticated JWT signing algorithm in routing | Cloud Foundry
CVE-2016-8218: Unauthenticated JWT signing algorithm in routing Critical Vendor Cloud Foundry Foundation Versions Affected routing-release versions prior to 0.142.0 cf-release versions 203 to 231 Description Incomplete validation logic in JSON Web Token JWT libraries can allow unprivileged...
Critical vulnerabilities in JSON Web Token libraries
More info at https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/...
Critical vulnerabilities in JSON Web Token libraries
More info at https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/...
[SECURITY] [DSA 3293-1] pyjwt security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3293-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini June 20, 2015 https://www.debian.org/security/faq -...
[SECURITY] Fedora 22 Update: python-jwt-1.3.0-1.fc22
A Python implementation of JSON Web Token draft 01. This library provides a means of representing signed content using JSON data structures, including claims to be transferred between two parties encoded as digitally signed and encrypted JSON objects...
Debian DSA-3293-1 : pyjwt - security update
Tim McLean discovered that pyjwt, a Python implementation of JSON Web Token, would try to verify an HMAC signature using an RSA or ECDSA public key as secret. This could allow remote attackers to trick applications expecting tokens signed with asymmetric keys, into accepting arbitrary tokens. For...
[SECURITY] [DSA 3293-1] pyjwt security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3293-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini June 20, 2015 https://www.debian.org/security/faq -...
DSA-3293-1 pyjwt - security update
Bulletin has no description...
Debian Security Advisory DSA 3293-1 (pyjwt - security update)
Tim McLean discovered that pyjwt, a Python implementation of JSON Web Token, would try to verify an HMAC signature using an RSA or ECDSA public key as secret. This could allow remote attackers to trick applications expecting tokens signed with asymmetric keys, into accepting arbitrary tokens. For...
F21 JWT JWT.PHP Signature Bypass Vulnerability
F21 JWT provides PHP libraries for processing JSON WEB tokens. A security vulnerability in F21 JWT JWT.php allows remote attackers to bypass signature verification by submitting a special token...
Critical vulnerabilities in JSON Web Token libraries
More info at https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/...
Critical vulnerabilities in JSON Web Token libraries
More info at https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/...
Critical Vulnerabilities Affecting JSON Web Token Libraries
Critical vulnerabilities exist in several JSON Web Token JWT libraries – namely the JavaScript and PHP versions – that could let an attacker bypass the verification step. Tim McLean, a Canadian security researcher who specializes in cryptography and dug up the issues, points out that attackers...