CVE-2017-2585

CVE-2017-2585 affects Red Hat Keycloak before version 2.5.1, where JWS token HMAC verification is implemented in non-constant time, potentially enabling timing attacks. Documents across OSV/GHSA/NVD reiterate this exact flaw for Keycloak; no explicit exploit details or affected version ranges bey...

CVE-2018-0114

A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for JSON Web Tokens JWTs...

Code injection

A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for JSON Web Tokens JWTs...

CVE-2018-0114

A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for JSON Web Tokens JWTs...

CVE-2018-0114

A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for JSON Web Tokens JWTs...

Timing Attacks

keycloak-core is vulnerable to timing attacks. The vulnerability is possible because the HMAC signature comparison algorithm used by its JWS token code is not performed in constant time. Therefore, an attacker can trigger a timing attack through the JWS tokens...

tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener

The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 security and enhancement update

An update is now available for Red Hat JBoss Web Server 3 for RHEL 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener

The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker...

[SECURITY] Fedora 23 Update: python-jwcrypto-0.3.2-1.fc23

Implements JWK,JWS,JWE specifications using python-cryptography...

[SECURITY] Fedora 24 Update: python-jwcrypto-0.3.2-1.fc24

Implements JWK,JWS,JWE specifications using python-cryptography...

[SECURITY] Fedora 25 Update: python-jwcrypto-0.3.2-1.fc25

Implements JWK,JWS,JWE specifications using python-cryptography...

Forgeable Public/Private Tokens

Overview Affected versions of the jws package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use case of the JWT as a bearer...

RHEL 7 : JBoss Web Server (RHSA-2015:2660)

Updated Red Hat JBoss Web Server 3.0.2 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for each...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.2 security update

Updated Red Hat JBoss Web Server 3.0.2 packages are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for each...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.2 security update

Updated Red Hat JBoss Web Server 3.0.2 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for each...

PT-2015-3347

Name of the Vulnerable Software and Affected Versions Red Hat JBoss A-MQ versions 6.x Red Hat BPM Suite BPMS versions 6.x Red Hat BRMS versions 5.x and 6.x Red Hat Data Grid JDG versions 6.x Red Hat Data Virtualization JDV versions 5.x and 6.x Red Hat Enterprise Application Platform versions 4.3....

Oracle Java IE Browser Plugin docbase Parameter Stack Buffer Overflow

Added: 10/15/2010 CVE: CVE-2010-3552 BID: 44023 Background Oracle Java SE and Java for Business are development platforms for developing and deploying Java applications. They include the Java SE Development Kit JDK and the Java Runtime Environment JRE. The JRE provides the minimum requirements fo...

Oracle Java IE Browser Plugin docbase Parameter Stack Buffer Overflow

Added: 10/15/2010 CVE: CVE-2010-3552 BID: 44023 Background Oracle Java SE and Java for Business are development platforms for developing and deploying Java applications. They include the Java SE Development Kit JDK and the Java Runtime Environment JRE. The JRE provides the minimum requirements fo...

iDefense Security Advisory 03.26.09: Sun Java Web Start (JWS ) GIF Decoding Heap Corruption Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDefense Security Advisory 03.25.09 http://labs.idefense.com/intelligence/vulnerabilities/ Mar 25, 2009 I. BACKGROUND Java Web Start JWS is a framework built by Sun that is used to run Java applications outside of the browser. It is distributed with t...