CVE-2017-18239 Exposure of Sensitive information in authentikat-jwt
CriticalCVSS 9.8
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt (aka com.jason-goodwin/authentikat-jwt) version 0.4.5 and earlier allows the supplier of a JWT token to guess bit after bit of the signature by repeating validation requests.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.jason-goodwin/authentikat-jwt_2.12(Maven) | <= 0.4.5 | No fix listed |
| com.jason-goodwin/authentikat-jwt_2.12(Maven) | < 0.4.6 | 0.4.6 |
| com.jason-goodwin/authentikat-jwt_2.12(Maven) | = 0.4.4 | No fix listed |
| com.jason-goodwin/authentikat-jwt_2.12(Maven) | = 0.4.5 | No fix listed |
| authentikat-jwt project authentikat-jwt | <= 0.4.5 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking third-party-advisory
- github.com issue-tracking patch third-party-advisory
- github.com patch third-party-advisory
- github.com vendor-advisory
- github.com product