Homepage
About Snyk

Signature Validation Bypass Affecting json-jwt package, versions <1.9.4

Severity

 Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    EPSS
    0.1% (42nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-RUBY-JSONJWT-22038
  • published 28 Jun 2018
  • disclosed 2 May 2018
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 2 May 2018

CVE-2018-1000539 Open this link in a new tab
CWE-347 Open this link in a new tab

How to fix?

Upgrade json-jwt to version 1.9.4 or higher.

Overview

json-jwt is a JSON Web Token and its family (JSON Web Signature, JSON Web Encryption and JSON Web Key) in Ruby.

Affected versions of this package are vulnerable to Signature Validation Bypass. Due to Improper Verification of Cryptographic Signature, an attacker could forge an forge an authentication tag.

CVSS Scores

version 3.1
Expand this section

Snyk

Recommended
5.3 medium
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    None
  • Integrity (I)
    Low
  • Availability (A)
    None