GHSA-mj4x-wcxf-hm8x

Json-jwt did not verify the cryptographic signature for data

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1000539

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	json-jwt	>= 0.5.1, < 1.9.4	1.9.4

Details

As written in the advisory (Markdown source, shown as plain text).

The json-jwt rubygem version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 1.9.4 and later.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000539 advisory
https://github.com/nov/json-jwt/pull/62 web
https://github.com/nov/json-jwt/commit/a3b2147f0f6d9aca653e7a30e453d3a92b33413f web
https://github.com/nov/json-jwt package
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/json-jwt/CVE-2018-1000539.yml web
https://www.debian.org/security/2018/dsa-4283 web