Invalid Curve Attack

🗓️ 21 Aug 2017 05:30:51Reported by Veracode Vulnerability DatabaseType

veracode

veracode🔗 sca.analysiscenter.veracode.com👁 20 Views

nimbus-jose-jwt vulnerability to invalid curve attacks

Reporter	Title	Published	Views	Family All 17
IBM Security Bulletins	Security Bulletin: Three vulnerabilities in Nimbus JOSE+JWT affect IBM Spectrum Conductor	3 Jun 202008:30	–	ibm
IBM Security Bulletins	Security Bulletin: Public disclosed vulnerability from Nimbus-JOSE-JWT affects IBM Spectrum LSF	6 Mar 201905:15	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been identified in DB2 that affect the IBM Performance Management product	20 May 202014:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Nimbus-JOSE-JWT affect IBM Spectrum Symphony	17 Apr 202008:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Db2® Warehouse has released a fix in response to multiple vulnerabilities found in IBM Db2®	19 Apr 202116:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilities	6 Mar 202616:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE)	24 Aug 202010:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in dependent libraries affect IBM® Db2® leading to denial of service or privilege escalation.	10 Mar 202121:20	–	ibm
BDU FSTEC	The vulnerability of the Nimbus JOSE + JWT Java library, related to incorrect verification of the cryptographic signature, allows a perpetrator to influence the integrity of the information.	2 Aug 202200:00	–	bdu_fstec
CNVD	Nimbus JOSE+JWT Invalid Curve Attack Information Disclosure Vulnerability	21 Aug 201700:00	–	cnvd

Vulners

Node

nimbus-jose-jwt nimbus-jose-jwtRange2.9–2.11.0java

OR

nimbus-jose-jwt nimbus-jose-jwtMatch4.35java

OR

nimbus-jose-jwt nimbus-jose-jwtRange2.12.0–2.15.2java

OR

nimbus-jose-jwt nimbus-jose-jwtRange2.16–2.22.1java

OR

nimbus-jose-jwt nimbus-jose-jwtRange2.23–3.10java

OR

nimbus-jose-jwt nimbus-jose-jwtRange4.0-rc1–4.14java

OR

nimbus-jose-jwt nimbus-jose-jwtRange4.16.2–4.33java

OR

nimbus-jose-jwt nimbus-jose-jwtRange4.34–4.34.2java

OR

nimbus-jose-jwt nimbus-jose-jwtMatch4.16java

OR

nimbus-jose-jwt nimbus-jose-jwtRange4.15–4.15.1java

OR

nimbus-jose-jwt nimbus-jose-jwtMatch4.16.1java

Source	Link
bitbucket	www.bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt
bitbucket	www.bitbucket.org/connect2id/nimbus-jose-jwt/issues/217/explicit-check-for-ec-public-key-on-curve
lists	www.lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
lists	www.lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E
bitbucket	www.bitbucket.org/connect2id/nimbus-jose-jwt/commits/f3a7a801f0c6b078899fed9226368eb7b44e2b2f
bitbucket	www.bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt

08 Nov 2023 00:45Current

7.9High risk

Vulners AI Score7.9

CVSS 25

CVSS 37.5

EPSS0.00141

nimbus-jose-jwt invalid curve attack jce provider curve validation software