Lucene search
Veracode Vulnerability DatabaseVERACODE:4920HistoryAug 21, 2017 - 4:33 a.m.
Padding Oracle Attack
2017-08-2104:33:21
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
7
0.001 Low
EPSS
Percentile
31.0%
nimbus-jose-jwt is vulnerable to padding oracle attacks. It does not act correctly if an invalid HMAC is detected in authenticated AES-CBC decryption.
| CPE | Name | Operator | Version |
|---|---|---|---|
| nimbus jose+jwt | eq | 4.16 | |
| nimbus jose+jwt | le | 4.38 | |
| nimbus jose+jwt | le | 4.14 | |
| nimbus jose+jwt | le | 2.22.1 |
References
bitbucket.org/connect2id/nimbus-jose-jwt/commits/6a29f10f723f406eb25555f55842c59a43a38912
bitbucket.org/connect2id/nimbus-jose-jwt/issues/223/aescbc-return-immediately-on-invalid-hmac
bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt
bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt?fileviewer=file-view-default
Related
osv
osv
CVE-2017-12973
2017-08-20 16:29:00
Nimbus JOSE+JWT vulnerable to padding oracle attack
2022-05-13 01:42:51
nvd
nvd
CVE-2017-12973
2017-08-20 16:29:00
cve
cve
CVE-2017-12973
2022-10-03 16:23:17
github
github
Nimbus JOSE+JWT vulnerable to padding oracle attack
2022-05-13 01:42:51
cvelist
cvelist
CVE-2017-12973
2022-10-03 16:23:17
prion
prion
Design/Logic Flaw
2017-08-20 16:29:00
ibm
ibm