5401 matches found
Timing Attack
json-jwt is vulnerable to timing attacks. The library is vulnerable because they do not compare signatures in constant-time, which allows malicious users to use the timing of the request to progressively identify a valid signatures...
CVE-2016-8218: Unauthenticated JWT signing algorithm in routing | Cloud Foundry
CVE-2016-8218: Unauthenticated JWT signing algorithm in routing Critical Vendor Cloud Foundry Foundation Versions Affected routing-release versions prior to 0.142.0 cf-release versions 203 to 231 Description Incomplete validation logic in JSON Web Token JWT libraries can allow unprivileged...
Forgeable Public/Private Tokens
Overview Affected versions of the jws package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use case of the JWT as a bearer...
Forgeable Public/Private Tokens
Overview Affected versions of the jwt-simple package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use case of the JWT, the en...
Verification Bypass
Overview Versions 4.2.1 and earlier of jsonwebtoken are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT algorithm type, occuring when an attacker is allowed to arbitrarily specify the JWT algorithm. Recommendation Update to version 4.2.2 or later...
Fedora Update for python-jwt FEDORA-2015-10350
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Design/Logic Flaw
NAMSHI | JOSE 5.0.0 and earlier allows remote attackers to bypass signature verification via crafted tokens in a JSON Web Tokens JWT header...
CVE-2015-2964
CVE-2015-2964 affects namshi/jose (PHP JWT library). A vulnerability in processing JWT headers allows bypass of signature verification, enabling specially crafted tokens to be treated as valid data. Public sources indicate the library did not properly enforce signature checks (e.g., issues with t...
PT-2015-6012
Name of the Vulnerable Software and Affected Versions NAMSHI | JOSE versions 5.0.0 and earlier Description The issue allows remote attackers to bypass signature verification via crafted tokens in a JSON Web Tokens JWT header. Recommendations For versions 5.0.0 and earlier, at the moment, there is...
CVE-2015-2964: Improper Input Validation
NAMSHI | JOSE 5.0.0 and earlier allows remote attackers to bypass signature verification via crafted tokens in a JSON Web Tokens JWT header...
Fedora Update for python-jwt FEDORA-2015-10249
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora 21 : python-jwt-1.3.0-1.fc21 (2015-10249)
Latest upstream with security fix for http://seclists.org/oss-sec/2015/q2/3 https://github.com/jpadilla/pyjwt/commit/88a9fc56bdc6c870aa6af93bda401 414a217db2a Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has...
Fedora 22 : python-jwt-1.3.0-1.fc22 (2015-10350)
Latest upstream with security fix for http://seclists.org/oss-sec/2015/q2/3 https://github.com/jpadilla/pyjwt/commit/88a9fc56bdc6c870aa6af93bda401 414a217db2a Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has...
JVN#25336719: namshi/jose fails to verify token signatures
namshi/jose is a PHP library for handling JSON Web Tokens JWT. namshi/jose contains a vulnerability in processing JWT headers where it fails to verify token signatures. Impact Specially crafted tokens may be validated as token data with valid signatures. Solution Update the Software Update to the...
CVE-2015-2951
JWT.php in F21 JWT before 2.0 allows remote attackers to bypass signature verification via crafted tokens...
CVE-2015-2951
JWT.php in F21 JWT before 2.0 allows remote attackers to bypass signature verification via crafted tokens...
CVE-2015-2951
JWT.php in F21 JWT before 2.0 allows remote attackers to bypass signature verification via crafted tokens...
CVE-2015-2951
The CVE-2015-2951 detail involves the F21 JWT PHP library (JWT.php) where versions before 2.0 fail to verify token signatures, enabling remote attackers to bypass signature verification via crafted tokens. Affected component is the PHP JWT token processor; root cause is signature verification byp...
PT-2015-5999
Name of the Vulnerable Software and Affected Versions F21 JWT versions prior to 2.0 Description The issue allows remote attackers to bypass signature verification via crafted tokens. Recommendations For versions prior to 2.0, update to version 2.0 or later to resolve the issue...