com.nimbusds:nimbus-jose-jwt@3.8 vulnerabilities

com.nimbusds:nimbus-jose-jwt is a library for JSON Web Tokens (JWT)

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to a large JWE p2c header value (AKA iteration count) for the PasswordBasedDecrypter (PBKDF2) class. An attacker can cause resource consumption by specifying an excessively large iteration count.

Upgrade com.nimbusds:nimbus-jose-jwt to version 9.37.2 or higher.

com.nimbusds:nimbus-jose-jwt is a library for JSON Web Tokens (JWT)

Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity due to missing validation for integer overflow when converting length values from bytes to bits. Exploiting this vulnerability allows attackers to conduct HMAC bypass attacks by shifting Additional Authenticated Data (AAD) and ciphertext so that different plaintext is obtained for the same HMAC.

Note: This vulnerability only affects JWE decryption with A128CBC-HS256, A192CBC-HS384, and A256CBC-HS512 encryption methods.

Upgrade com.nimbusds:nimbus-jose-jwt to version 4.39 or higher.

com.nimbusds:nimbus-jose-jwt is a library for JSON Web Tokens (JWT)

Affected versions of this package are vulnerable to Cryptographic Issues when it proceeds improperly after detecting an invalid HMAC in authenticated AES-CBC decryption in JWE with the A128CBC-HS256, A192CBC-HS384, and A256CBC-HS512 encryption methods. Exploiting this vulnerability allows attackers to conduct a padding oracle attack.

Upgrade com.nimbusds:nimbus-jose-jwt to version 4.39 or higher.

com.nimbusds:nimbus-jose-jwt is a library for JSON Web Tokens (JWT)

Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions. Can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.

Upgrade com.nimbusds:nimbus-jose-jwt to version 7.8.1 or higher.

com.nimbusds:nimbus-jose-jwt is a Java library for Javascript Object Signing and Encryption (JOSE) and JSON Web Tokens (JWT).

Affected versions of the package are vulnerable to an Invalid Elliptic Curve Attack.

Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows attackers to conduct an Invalid Curve Attack in environments where the JCE provider lacks the applicable curve validation.

Upgrade com.nimbusds:nimbus-jose-jwt to version 4.36 or higher.

com.nimbusds:nimbus-jose-jwt is a library for JSON Web Tokens (JWT)

Affected versions of this package are vulnerable to Elliptic Curve Key Disclosure. A JSON Web Token (JWT) defines a container that transports data between two parties. When a JWT is signed with a private key by one of the parties, it's known as a JSON Web Signature (JWS).

The "JWK" (JSON Web Key) is a JSON based open standard used for creating access tokens. JWK's Header Parameter allows it to include the public key that corresponds to the key used to sign the JWS. If the Header Parameter includes this public key, an attacker could then use it to generate a private key / public key pair, send the public key together with the signature and the signature will be valid.

This vulnerability is related to SNYK-JAVA-ORGBITBUCKETBC-30206 and npm:node-jose:20170313

Upgrade com.nimbusds:nimbus-jose-jwt to version 4.34.2 or higher.