CVE-2023-51774

The json-jwt (aka JSON::JWT) gem for Ruby, specifically versions 1.16.x before 1.16.6 and 1.15.x before 1.15.3.1 , contains a vulnerability allowing attackers to bypass identity checks via a sign/encryption confusion attack . For instance, JWE can be used to bypass JSON::JWT.decode. This vulnerab...

CVE-2019-18848

CVE-2019-18848 affects the rubygem-json-jwt library for Ruby, where versions prior to 1.11.0 fail to enforce an element count when splitting a JWE string. This is documented across multiple advisories (Debian DLA-2390-1, openSUSE/SUSE advisories) indicating the issue and references to upgrading t...

CVE-2018-1000539

CVE-2018-1000539 affects the ruby-json-jwt gem (versions >=0.5.0 and