43 matches found
CVE-2026-33996
LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the...
CVE-2026-33996 LibJWT has NULL/bounds validation in JWK octet and RSA PSS parsing
LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the...
CVE-2026-33996
LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the...
CVE-2026-33996 LibJWT has NULL/bounds validation in JWK octet and RSA PSS parsing
LibJWT is a C JSON Web Token Library. Starting in version 3.0.0 and prior to version 3.3.0, the JWK parsing for RSA-PSS did not protect against a NULL value when expecting to parse JSON string values. A specially crafted JWK file could exploit this behavior by using integers in places where the...
libjwt 代码问题漏洞
LibJWT is a C-language library developed by Ben Collins, designed for generating and verifying JSON Web Tokens. Versions of LibJWT from 3.0.0 to 3.3.0 contained code vulnerabilities. These vulnerabilities stemmed from RSA-PSS’s JWK parsing mechanism, which did not properly handle empty values,...
PT-2026-28589
Name of the Vulnerable Software and Affected Versions LibJWT versions 3.0.0 through 3.2.9 Description LibJWT, a C JSON Web Token Library, has an issue in the RSA-PSS JWK parsing functionality. Versions prior to 3.3.0 do not adequately validate JSON string values, specifically failing to protect...
Linux Distros Unpatched Vulnerability : CVE-2024-25189
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libjwt 1.15.3 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...
Debian dla-3739 : libjwt-dev - security update
The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3739 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3739-1 [email protected] https://www.debian.org/lts/security/...
Debian: Security Advisory (DLA-3739-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DLA 3739-1] libjwt security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-3739-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz February 24, 2024 https://wiki.debian.org/LTS -...
DLA-3739-1 libjwt - security update
Bulletin has no description...
Authentication Bypass
Overview Affected versions of this package are vulnerable to Authentication Bypass due to the insecure use of strcmp. Remediation There is no fixed version for libjwt. References - Report - Vulnerable Code Credit: P3ngu1nW...
CVE-2024-25189
libjwt 1.15.3 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...
DEBIAN-CVE-2024-25189
libjwt 1.15.3 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...
Authentication flaw
libjwt 1.15.3 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...
UBUNTU-CVE-2024-25189
libjwt 1.15.3 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...
CVE-2024-25189
libjwt 1.15.3 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...
CVE-2024-25189
libjwt 1.15.3 uses strcmp which is not constant time to verify authentication, which makes it easier to bypass authentication via a timing side channel...
CVE-2024-25189
The CVE concerns libjwt: 1.15.3 uses strcmp (not constant time) to verify authentication, enabling a timing side‑channel bypass. Connected sources confirm this is a legitimate vulnerability with high impact (CVE-2024-25189) and note Debian LTS advisories and Debian/DLA entries recommending an upg...
