Description
Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 1.9.4 and later.
References (2)
Core 2
Core References
Third Party Advisory x_refsource_misc
https://github.com/nov/json-jwt/pull/62
Third Party Advisory vendor-advisory
x_refsource_debian
https://www.debian.org/security/2018/dsa-4283
Scores
CVSS v3
5.3
EPSS
0.0014
EPSS Percentile
33.6%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Details
CWE
CWE-347
Status
published
Products (2)
json-jwt_project/json-jwt
0.5.0 - 1.9.4
rubygems/json-jwt
0.5.1 - 1.9.4RubyGems
Published
Jun 26, 2018
Tracked Since
Feb 18, 2026