Invalid Curve Attack

2017-08-2105:30:51

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.002 Low

EPSS

Percentile

55.4%

JSON

nimbus-jose-jwt is vulnerable to invalid curve attacks. The attacks are possible because the library does not make sure that the public x and y coordinates are on the specified curve in environments where the JCE provider lacks curve validation.

CPENameOperatorVersion
nimbus jose+jwteq4.16
nimbus jose+jwteq4.35
nimbus jose+jwteq4.16.1
nimbus jose+jwtle2.11.0
nimbus jose+jwtle2.15.2
nimbus jose+jwtle4.33
nimbus jose+jwtle2.22.1
nimbus jose+jwtle4.15.1
nimbus jose+jwtle3.10
nimbus jose+jwtle4.34.2

Name	Operator	Version
nimbus jose+jwt	eq	4.16
nimbus jose+jwt	eq	4.35
nimbus jose+jwt	eq	4.16.1
nimbus jose+jwt	le	2.11.0
nimbus jose+jwt	le	2.15.2
nimbus jose+jwt	le	4.33
nimbus jose+jwt	le	2.22.1
nimbus jose+jwt	le	4.15.1
nimbus jose+jwt	le	3.10
nimbus jose+jwt	le	4.34.2