CVE-2018-1000539

Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper
Verification of Cryptographic Signature vulnerability in Decryption of
AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a
authentication tag. This attack appear to be exploitable via network
connectivity. This vulnerability appears to have been fixed in 1.9.4 and
later.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=902721&gt;