Authentication Bypass

🗓️ 21 Aug 2017 01:57:01Reported by Veracode Vulnerability DatabaseType

veracode

veracode🔗 sca.analysiscenter.veracode.com👁 24 Views

nimbus-jose-jwt authentication bypass vulnerabilit

Reporter	Title	Published	Views	Family All 18
IBM Security Bulletins	Security Bulletin: Three vulnerabilities in Nimbus JOSE+JWT affect IBM Spectrum Conductor	3 Jun 202008:30	–	ibm
IBM Security Bulletins	Security Bulletin: Public disclosed vulnerability from Nimbus-JOSE-JWT affects IBM Spectrum LSF	6 Mar 201905:15	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been identified in DB2 that affect the IBM Performance Management product	20 May 202014:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Nimbus-JOSE-JWT affect IBM Spectrum Symphony	17 Apr 202008:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Db2® Warehouse has released a fix in response to multiple vulnerabilities found in IBM Db2®	19 Apr 202116:53	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in IBM® DB2® shipped with IBM PureData System for Operational Analytics	29 Apr 202501:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilities	6 Mar 202616:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE)	24 Aug 202010:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in dependent libraries affect IBM® Db2® leading to denial of service or privilege escalation.	10 Mar 202121:20	–	ibm
BDU FSTEC	The vulnerability of the AAD Handler component in the Nimbus JOSE + JWT Java library, due to insufficient data authentication checks, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.	2 Aug 202200:00	–	bdu_fstec

Vulners

Node

nimbus-jose-jwt nimbus-jose-jwtRange4.0-rc1–4.14java

OR

nimbus-jose-jwt nimbus-jose-jwtMatch4.16java

OR

nimbus-jose-jwt nimbus-jose-jwtRange4.16.2–4.38java

Source	Link
bitbucket	www.bitbucket.org/connect2id/nimbus-jose-jwt/issues/224/
bitbucket	www.bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt
lists	www.lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E
lists	www.lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
bitbucket	www.bitbucket.org/connect2id/nimbus-jose-jwt/commits/0d2bd649ea386539220d4facfe1f65eb1dadb86c
bitbucket	www.bitbucket.org/connect2id/nimbus-jose-jwt/issues/224/byte-to-bit-overflow-in-cbc
bitbucket	www.bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt

08 Nov 2023 00:49Current

8.1High risk

Vulners AI Score8.1

CVSS 25

CVSS 37.5

EPSS0.00149

nimbus-jose-jwt authentication bypass integer-overflow aad ciphertext hmac