CVE-2023-51774

2024-02-2900:00:00

ubuntu.com

security vulnerability

json-jwt

ruby

identity check bypass

sign/encryption confusion attack

jwe

bug fix

github

issue

7 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

8.6%

JSON

The json-jwt (aka JSON::JWT) gem 1.16.3 for Ruby sometimes allows bypass of
identity checks via a sign/encryption confusion attack. For example, JWE
can sometimes be used to bypass JSON::JWT.decode.

Bugs

<https://github.com/nov/json-jwt/issues/113>

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchruby-json-jwt< anyUNKNOWN
ubuntu20.04noarchruby-json-jwt< anyUNKNOWN
ubuntu22.04noarchruby-json-jwt< anyUNKNOWN
ubuntu23.10noarchruby-json-jwt< anyUNKNOWN
ubuntu24.04noarchruby-json-jwt< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	ruby-json-jwt	< any	UNKNOWN
ubuntu	20.04	noarch	ruby-json-jwt	< any	UNKNOWN
ubuntu	22.04	noarch	ruby-json-jwt	< any	UNKNOWN
ubuntu	23.10	noarch	ruby-json-jwt	< any	UNKNOWN
ubuntu	24.04	noarch	ruby-json-jwt	< any	UNKNOWN