CVE-2016-5429 jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via a timing attack, related to JWE.php and....
LowCVSS 3.7
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via a timing attack, related to JWE.php and JWS.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jose-php project jose-php | <= 2.2.0 | No fix listed |
References
- 92743 third-party-advisory vdb-entry
- github.com patch
- github.com patch