~ / search / GHSA-c8v6-786g-vjx6

GHSA-c8v6-786g-vjx6

json-jwt allows bypass of identity checks via a sign/encryption confusion attack

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-51774

Packages

EcosystemPackageAffectedFixed in
RubyGems json-jwt >= 1.16.0, < 1.16.6 1.16.6
RubyGems json-jwt < 1.15.3.1 1.15.3.1

Details

As written in the advisory (Markdown source, shown as plain text).

The json-jwt (aka JSON::JWT) gem 1.16.x before 1.16.6, 1.15.x before 1.15.3.1 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode.

References

External links from the advisory. They lead to third-party sites.