Incorrect Implementation of Authentication Algorithm Affecting io.acryl:datahub-client package, versions [,0.8.45)


Severity

Recommended
0.0
critical
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of Concept
EPSS
1.45% (87th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-JAVA-IOACRYL-3092129
  • published1 Nov 2022
  • disclosed31 Oct 2022
  • creditAlvaro Muñoz, Sylwia-budzynska, Peter Stöckli, Kevin Stubbings, Jorge

Introduced: 31 Oct 2022

CVE-2022-39366  (opens in a new tab)
CWE-303  (opens in a new tab)

How to fix?

Upgrade io.acryl:datahub-client to version 0.8.45 or higher.

Overview

Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm due to the 'StatelessTokenService' class not verifying the signature of JWT tokens. 'StatelessTokenService' class is using the parse method of io.jsonwebtoken.JwtParser, which does not perform a verification of the cryptographic token signature.

CVSS Base Scores

version 3.1