56 matches found
CVE-2023-51774
The CVE-2023-51774 entry concerns the json-jwt (JSON::JWT) Ruby gem, with version 1.16.3 publicly reported as vulnerable to a sign/encryption confusion attack that can bypass identity checks (e.g., JSON::JWT.decode). The NVD entry confirms a high-severity impact (C/H/I/A) with local/low attack co...
CVE-2023-51774
Removed by vendor...
CVE-2023-51774
The json-jwt aka JSON::JWT gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode...
PT-2023-31892 · Json-Jwt · Json-Jwt
Name of the Vulnerable Software and Affected Versions: json-jwt aka JSON::JWT versions 1.15.x through 1.15.3.0 json-jwt aka JSON::JWT versions 1.16.x through 1.16.5 Description: The issue allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be us...
CVE-2023-51774
The json-jwt aka JSON::JWT gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode...
CVE-2023-51774
The json-jwt aka JSON::JWT gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode...
SUSE CVE-2019-18848
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
Debian DLA-2390-1 : ruby-json-jwt security update
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string. Therefore, there was a need to explicitly specify the number of elements when splitting a JWE string. For Debian 9 stretch, this problem has been fixed in version 1.6.2-1+deb9u2. We recommend that...
Debian: Security Advisory (DLA-2390-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
DLA-2390-1 ruby-json-jwt - security update
Bulletin has no description...
JSON-jwt Gem lacked element count during splitting of JWE string
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
GHSA-CFF7-6H4Q-Q5PJ JSON-jwt Gem lacked element count during splitting of JWE string
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
json-jwt improper input validation due to lack of element count when splitting string
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
Denial Of Service (DoS)
json-jwt is vulnerable to denial of service. The lack of element counts during a JWE string splitting can lead to an application crash when more than expected number of elements exists in the JWE string. This vulnerability could potentially allow for the bypass of the signature validation...
DEBIAN-CVE-2019-18848
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
CVE-2019-18848
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
CVE-2019-18848
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
CVE-2019-18848
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
