GHSA-r65j-6h5f-4f92

Withdrawn: JJWT improperly generates signing keys

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-31033

Packages

Ecosystem	Package	Affected	Fixed in
Maven	io.jsonwebtoken:jjwt-impl	<= 0.12.5	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

## Withdrawn Advisory This advisory has been withdrawn because it has been found to be disputed. Please see the issue [here](https://github.com/jwtk/jjwt/issues/930#issuecomment-2032699358) for more information. ## Original Description JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-31033 advisory
https://github.com/jwtk/jjwt/issues/930#issuecomment-2032699358 web
https://github.com/2308652512/JJWT_BUG web
https://github.com/jwtk/jjwt package
https://github.com/jwtk/jjwt/blob/26948610fbef81eba867cbaad54b516d1874c70a/impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtParserBuilder.j… web
https://www.viralpatel.net/java-create-validate-jwt-token web