PT-2023-20213

Name of the Vulnerable Software and Affected Versions node-jose versions prior to 2.2.0 Description The issue is related to a Denial-of-Service DoS condition in the "fallback" crypto back-end of node-jose, which can be triggered by malicious input or randomly for some ECC operations. This conditi...

CVE-2023-25653: Loop with Unreachable Exit Condition

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption JOSE for web browsers and node.js-based servers. Prior to version 2.2.0, when using the non-default "fallback" crypto back-end, ECC operations in node-jose can trigger a Denial-of-Service DoS condition, due to a...

Cisco node-jose improper validation of JWT signature

A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for JSON Web Tokens JWTs...

GHSA-JFXM-W8G2-4RCV Cisco node-jose improper validation of JWT signature

A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for JSON Web Tokens JWTs...

@ciscospark/internal-plugin-board (>=1.0.0, <=1.28.2), @ciscospark/internal-plugin-calendar (>=1.0.0, <=1.28.2) +37 more potentially affected by CVE-2018-0114 via node-jose (>=0.9.4, <=0.10.0)

node-jose NPM version =0.9.4, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.4, =1.0.0, =1.0.0, =0.7.0, =0.7.92, =0.7.0, =0.7.71, =0.7.0, =0.7.0, =0.7.0, =0.1.137, =0.1.207 and more Source cves: CVE-2018-0114 Source advisory: OSV:GHSA-JFXM-W8G2-4RCV...

@ciscospark/internal-plugin-board (>=1.0.0, <=1.28.2), @ciscospark/internal-plugin-calendar (>=1.0.0, <=1.28.2) +37 more potentially affected by CVE-2018-0114 via node-jose (>=0.9.4, <=0.10.0)

node-jose NPM version =0.9.4, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.4, =1.0.0, =1.0.0, =0.7.0, =0.7.92, =0.7.0, =0.7.71, =0.7.0, =0.7.0, =0.7.0, =0.1.137, =0.1.207 and more Source cves: CVE-2018-0114 Source advisory: GHSA-JFXM-W8G2-4RCV...

Exploit for Improper Verification of Cryptographic Signature in Cisco Node-Jose

CVE-2018-0114 Exploitation of a vulnerability in Cisco's node-...

Exploit for Improper Verification of Cryptographic Signature in Cisco Node-Jose

CVE-2018-0114 python2.7 script for JWT generation CVE-2018-01...

Security Bulletin: Three vulnerabilities in Nimbus JOSE+JWT affect IBM Spectrum Conductor

Summary There are three vulnerabilities in Nimbus JOSE+JWT 3.1.2 used by IBM Spectrum Conductor 2.4.1, IBM Spectrum Conductor 2.4.0 and IBM Spectrum Conductor 2.3.0. IBM Spectrum Conductor 2.4.1, IBM Spectrum Conductor 2.4.0 and IBM Spectrum Conductor 2.3 have addressed the applicable CVEs...

Invalid Curve Attack in node-jose

Affected versions of node-jose are vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static ECDH-ES is used. Proof of Concept Recommendation Update to version 0.9.3 or later...

GHSA-RVJ9-8CVX-3VQ9 Invalid Curve Attack in node-jose

Affected versions of node-jose are vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static ECDH-ES is used. Proof of Concept Recommendation Update to version 0.9.3 or later...

node-jose information disclosure vulnerability

node-jose is a web browser and node.js based server JSON object signing and encryption of open source library . A security vulnerability exists in versions of node-jose prior to 0.9.3. An attacker can exploit the vulnerability to obtain sensitive information...

Code injection

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption JOSE for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 is vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key...

CVE-2017-16007

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption JOSE for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 is vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key...

CVE-2017-16007

CVE-2017-16007 affects the node-jose library prior to 0.9.3, where JWE with ECDH-ES can permit an invalid-curve attack and allow recovery of the private key. The vulnerability is described across NVD, OSV, GHSA, and IBM advisories, which also recommend upgrading to 0.9.3 or later as the remediati...

CVE-2017-16007

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption JOSE for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 is vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key...

CVE-2017-16007

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption JOSE for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 is vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key...

CVE-2017-16007: Exposure of Sensitive Information to an Unauthorized Actor

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption JOSE for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 is vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key...

PT-2018-6036

Name of the Vulnerable Software and Affected Versions: node-jose versions prior to 0.9.3 Description: The issue allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static ECDH-ES is used, due to an invalid curve attack...

Cisco node-jos Resign Tokens Proof Of Concept

import base64 import urllib import rsa import sys zi0Black ''' POC of CVE-2018-0114 Cisco node-jose 0.11.0 Created by Andrea Cappa aka @zi0Black GitHub,Twitter,Telegram Mail: [email protected] Site: https://zioblack.xyz A special thanks to Louis Nyffenegger, the founder of PentesterLab, for al...