Insufficient Verification of Data Authenticity Affecting com.nimbusds:nimbus-jose-jwt package, versions [,4.39)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-COMNIMBUSDS-3110420
- published 9 Nov 2022
- disclosed 13 May 2022
- credit Unknown
Introduced: 13 May 2022
CVE-2017-12972 Open this link in a new tabHow to fix?
Upgrade com.nimbusds:nimbus-jose-jwt to version 4.39 or higher.
Overview
com.nimbusds:nimbus-jose-jwt is a library for JSON Web Tokens (JWT)
Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity due to missing validation for integer overflow when converting length values from bytes to bits. Exploiting this vulnerability allows attackers to conduct HMAC bypass attacks by shifting Additional Authenticated Data (AAD) and ciphertext so that different plaintext is obtained for the same HMAC.
Note:
This vulnerability only affects JWE decryption with A128CBC-HS256, A192CBC-HS384, and A256CBC-HS512 encryption methods.