Security Bulletin: Worksoft Connective Automation Platform for IBM is affected by a vulnerability in jsonwebtokens

Summary jsonwebtokens is used by Worksoft Connective Automation Platform for IBM as part of .Net6 CVE-2024-21319 Vulnerability Details CVEID:CVE-2024-21319 DESCRIPTION: Microsoft Identity Denial of service vulnerability CWE:CWE-20: Improper Input Validation CVSS Source: IBM X-Force CVSS Base scor...

CVE-2022-23539

CVE-2022-23539 affects jsonwebtoken versions ≤ 8.5.1, where misconfiguration could allow legacy insecure key types to be used for signature verification (e.g., DSA with RS256). The issue has been fixed in v9.0.0, which validates asymmetric key type/algorithm combinations. After upgrading, if you ...

Input validation

In versions =8.5.1 of jsonwebtoken library, lack of algorithm definition in the jwt.verify function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Users are affected if you do not specify algorithms in the jwt.verify function. This issu...

CVE-2022-23540 jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

In versions =8.5.1 of jsonwebtoken library, lack of algorithm definition in the jwt.verify function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Users are affected if you do not specify algorithms in the jwt.verify function. This issu...