CVE-2017-12972 Nimbus JOSE+JWT missing overflow check
HighCVSS 7.5
EPSS 0.89%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers to conduct HMAC bypass attacks by shifting Additional Authenticated Data (AAD) and ciphertext so that different plaintext is obtained for the same HMAC.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.nimbusds/nimbus-jose-jwt(Maven) | < 4.39 | 4.39 |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.10 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.10.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.11.0 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.12.0 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.13.0 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.13.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.14.0 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.15.0 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.15.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.15.2 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.16 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.17 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.17.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.17.2 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.18 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.18.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.18.2 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.19 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.19.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.20 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.21 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.22 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.22.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.23 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.24 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.25 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.26 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.26.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 2.9 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 3.0 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 3.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 3.1.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 3.1.2 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 3.10 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 3.2 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 3.2.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 3.2.2 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 3.3 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 3.4 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 3.5 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 3.6 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 3.7 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 3.8 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 3.8.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 3.8.2 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 3.9 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 3.9.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 3.9.2 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.0 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.0-rc1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.0-rc2 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.0-rc3 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.0-rc4 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.0.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.1.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.10 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.11 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.11.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.11.2 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.12 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.13 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.13.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.14 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.15 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.15.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.16 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.16.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.16.2 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.17 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.18 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.19 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.2 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.20 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.21 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.22 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.23 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.24 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.25 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.26 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.26.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.27 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.27.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.28 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.29 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.3 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.3.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.30 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.31.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.32 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.33 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.34 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.34.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.34.2 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.35 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.36 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.36.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.37 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.37.1 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.38 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.4 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.5 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.6 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.7 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.8 | No fix listed |
| com.nimbusds/nimbus-jose-jwt(Maven) | = 4.9 | No fix listed |
| connect2id nimbus jose+jwt | = 1.0 | No fix listed |
| connect2id nimbus jose+jwt | = 1.1 | No fix listed |
| connect2id nimbus jose+jwt | = 1.2 | No fix listed |
| connect2id nimbus jose+jwt | = 1.3 | No fix listed |
| connect2id nimbus jose+jwt | = 1.4 | No fix listed |
| connect2id nimbus jose+jwt | = 1.5 | No fix listed |
| connect2id nimbus jose+jwt | = 1.6 | No fix listed |
| connect2id nimbus jose+jwt | = 1.7 | No fix listed |
| connect2id nimbus jose+jwt | = 1.8 | No fix listed |
| connect2id nimbus jose+jwt | = 1.9 | No fix listed |
| connect2id nimbus jose+jwt | = 1.9.1 | No fix listed |
| connect2id nimbus jose+jwt | = 1.10 | No fix listed |
| connect2id nimbus jose+jwt | = 1.11 | No fix listed |
| connect2id nimbus jose+jwt | = 1.12 | No fix listed |
| connect2id nimbus jose+jwt | = 2.0 | No fix listed |
| connect2id nimbus jose+jwt | = 2.0.1 | No fix listed |
| connect2id nimbus jose+jwt | = 2.1 | No fix listed |
| connect2id nimbus jose+jwt | = 2.1.1 | No fix listed |
| connect2id nimbus jose+jwt | = 2.2 | No fix listed |
| connect2id nimbus jose+jwt | = 2.3 | No fix listed |
| connect2id nimbus jose+jwt | = 2.4 | No fix listed |
| connect2id nimbus jose+jwt | = 2.5 | No fix listed |
| connect2id nimbus jose+jwt | = 2.6 | No fix listed |
| connect2id nimbus jose+jwt | = 2.7 | No fix listed |
| connect2id nimbus jose+jwt | = 2.8 | No fix listed |
| connect2id nimbus jose+jwt | = 2.9 | No fix listed |
| connect2id nimbus jose+jwt | = 2.10 | No fix listed |
| connect2id nimbus jose+jwt | = 2.10.1 | No fix listed |
| connect2id nimbus jose+jwt | = 2.11.0 | No fix listed |
| connect2id nimbus jose+jwt | = 2.12.0 | No fix listed |
| connect2id nimbus jose+jwt | = 2.13.0 | No fix listed |
| connect2id nimbus jose+jwt | = 2.13.1 | No fix listed |
| connect2id nimbus jose+jwt | = 2.14 | No fix listed |
| connect2id nimbus jose+jwt | = 2.15 | No fix listed |
| connect2id nimbus jose+jwt | = 2.15.1 | No fix listed |
| connect2id nimbus jose+jwt | = 2.15.2 | No fix listed |
| connect2id nimbus jose+jwt | = 2.16 | No fix listed |
| connect2id nimbus jose+jwt | = 2.17 | No fix listed |
| connect2id nimbus jose+jwt | = 2.17.1 | No fix listed |
| connect2id nimbus jose+jwt | = 2.17.2 | No fix listed |
| connect2id nimbus jose+jwt | = 2.18 | No fix listed |
| connect2id nimbus jose+jwt | = 2.18.1 | No fix listed |
| connect2id nimbus jose+jwt | = 2.18.2 | No fix listed |
| connect2id nimbus jose+jwt | = 2.19 | No fix listed |
| connect2id nimbus jose+jwt | = 2.19.1 | No fix listed |
| connect2id nimbus jose+jwt | = 2.20 | No fix listed |
| connect2id nimbus jose+jwt | = 2.21 | No fix listed |
| connect2id nimbus jose+jwt | = 2.22 | No fix listed |
| connect2id nimbus jose+jwt | = 2.22.1 | No fix listed |
| connect2id nimbus jose+jwt | = 2.23 | No fix listed |
| connect2id nimbus jose+jwt | = 2.24 | No fix listed |
| connect2id nimbus jose+jwt | = 2.25 | No fix listed |
| connect2id nimbus jose+jwt | = 2.26 | No fix listed |
| connect2id nimbus jose+jwt | = 2.26.1 | No fix listed |
| connect2id nimbus jose+jwt | = 3.0 | No fix listed |
| connect2id nimbus jose+jwt | = 3.1 | No fix listed |
| connect2id nimbus jose+jwt | = 3.1.1 | No fix listed |
| connect2id nimbus jose+jwt | = 3.1.2 | No fix listed |
| connect2id nimbus jose+jwt | = 3.2 | No fix listed |
| connect2id nimbus jose+jwt | = 3.2.1 | No fix listed |
| connect2id nimbus jose+jwt | = 3.2.2 | No fix listed |
| connect2id nimbus jose+jwt | = 3.3 | No fix listed |
| connect2id nimbus jose+jwt | = 3.4 | No fix listed |
| connect2id nimbus jose+jwt | = 3.5 | No fix listed |
| connect2id nimbus jose+jwt | = 3.6 | No fix listed |
| connect2id nimbus jose+jwt | = 3.7 | No fix listed |
| connect2id nimbus jose+jwt | = 3.8 | No fix listed |
| connect2id nimbus jose+jwt | = 3.8.1 | No fix listed |
| connect2id nimbus jose+jwt | = 3.8.2 | No fix listed |
| connect2id nimbus jose+jwt | = 3.9 | No fix listed |
| connect2id nimbus jose+jwt | = 3.9.1 | No fix listed |
| connect2id nimbus jose+jwt | = 3.9.2 | No fix listed |
| connect2id nimbus jose+jwt | = 3.10 | No fix listed |
| connect2id nimbus jose+jwt | = 4.0 | No fix listed |
| connect2id nimbus jose+jwt | = 4.0.1 | No fix listed |
| connect2id nimbus jose+jwt | = 4.1 | No fix listed |
| connect2id nimbus jose+jwt | = 4.1.1 | No fix listed |
| connect2id nimbus jose+jwt | = 4.2 | No fix listed |
| connect2id nimbus jose+jwt | = 4.3 | No fix listed |
| connect2id nimbus jose+jwt | = 4.3.1 | No fix listed |
| connect2id nimbus jose+jwt | = 4.4 | No fix listed |
| connect2id nimbus jose+jwt | = 4.5 | No fix listed |
| connect2id nimbus jose+jwt | = 4.6 | No fix listed |
| connect2id nimbus jose+jwt | = 4.7 | No fix listed |
| connect2id nimbus jose+jwt | = 4.8 | No fix listed |
| connect2id nimbus jose+jwt | = 4.9 | No fix listed |
| connect2id nimbus jose+jwt | = 4.10 | No fix listed |
| connect2id nimbus jose+jwt | = 4.11 | No fix listed |
| connect2id nimbus jose+jwt | = 4.11.1 | No fix listed |
| connect2id nimbus jose+jwt | = 4.11.2 | No fix listed |
| connect2id nimbus jose+jwt | = 4.12 | No fix listed |
| connect2id nimbus jose+jwt | = 4.13 | No fix listed |
| connect2id nimbus jose+jwt | = 4.13.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bitbucket.org third-party-advisory
- bitbucket.org patch third-party-advisory
- bitbucket.org release-notes third-party-advisory
- lists.apache.org
- github.com
- [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities mailing-list