Vulnerability Database

289,697

Total vulnerabilities in the database

CVE-2017-12972

In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers to conduct HMAC bypass attacks by shifting Additional Authenticated Data (AAD) and ciphertext so that different plaintext is obtained for the same HMAC.

CVSS v3:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v2:

  • Severity: Medium
  • Score: 5
  • AV:N/AC:L/Au:N/C:N/I:P/A:N

CWEs:

Software From Fixed in
connect2id / nimbus_jose+jwt 1.9.1 1.9.1.x
connect2id / nimbus_jose+jwt 4.0 4.0.x
connect2id / nimbus_jose+jwt 2.6 2.6.x
connect2id / nimbus_jose+jwt 1.4 1.4.x
connect2id / nimbus_jose+jwt 4.3 4.3.x
connect2id / nimbus_jose+jwt 2.1 2.1.x
connect2id / nimbus_jose+jwt 2.16 2.16.x
connect2id / nimbus_jose+jwt 2.19 2.19.x
connect2id / nimbus_jose+jwt 2.10.1 2.10.1.x
connect2id / nimbus_jose+jwt 4.34.2 4.34.2.x
connect2id / nimbus_jose+jwt 1.7 1.7.x
connect2id / nimbus_jose+jwt 4.17 4.17.x
connect2id / nimbus_jose+jwt 1.10 1.10.x
connect2id / nimbus_jose+jwt 2.22 2.22.x
connect2id / nimbus_jose+jwt 4.31.1 4.31.1.x
connect2id / nimbus_jose+jwt 2.25 2.25.x
connect2id / nimbus_jose+jwt 4.1.1 4.1.1.x
connect2id / nimbus_jose+jwt 4.6 4.6.x
connect2id / nimbus_jose+jwt 3.4 3.4.x
connect2id / nimbus_jose+jwt 4.24 4.24.x
connect2id / nimbus_jose+jwt 2.13.0 2.13.0.x
connect2id / nimbus_jose+jwt 2.15.2 2.15.2.x
connect2id / nimbus_jose+jwt 4.8 4.8.x
connect2id / nimbus_jose+jwt 4.35 4.35.x
connect2id / nimbus_jose+jwt 1.9 1.9.x
connect2id / nimbus_jose+jwt 3.2.1 3.2.1.x
connect2id / nimbus_jose+jwt 2.20 2.20.x
connect2id / nimbus_jose+jwt 2.1.1 2.1.1.x
connect2id / nimbus_jose+jwt 3.5 3.5.x
connect2id / nimbus_jose+jwt 1.5 1.5.x
connect2id / nimbus_jose+jwt 2.17.2 2.17.2.x
connect2id / nimbus_jose+jwt 4.37 4.37.x
connect2id / nimbus_jose+jwt 4.38 4.38.x
connect2id / nimbus_jose+jwt 2.4 2.4.x
connect2id / nimbus_jose+jwt 3.1 3.1.x
connect2id / nimbus_jose+jwt 4.9 4.9.x
connect2id / nimbus_jose+jwt 2.24 2.24.x
connect2id / nimbus_jose+jwt 3.6 3.6.x
connect2id / nimbus_jose+jwt 2.10 2.10.x
connect2id / nimbus_jose+jwt 4.10 4.10.x
connect2id / nimbus_jose+jwt 3.10 3.10.x
connect2id / nimbus_jose+jwt 2.17 2.17.x
connect2id / nimbus_jose+jwt 4.34 4.34.x
connect2id / nimbus_jose+jwt 4.27.1 4.27.1.x
connect2id / nimbus_jose+jwt 3.7 3.7.x
connect2id / nimbus_jose+jwt 1.1 1.1.x
connect2id / nimbus_jose+jwt 4.13.1 4.13.1.x
connect2id / nimbus_jose+jwt 4.27 4.27.x
connect2id / nimbus_jose+jwt 2.18.1 2.18.1.x
connect2id / nimbus_jose+jwt 4.16.1 4.16.1.x
connect2id / nimbus_jose+jwt 4.21 4.21.x
connect2id / nimbus_jose+jwt 4.19 4.19.x
connect2id / nimbus_jose+jwt 2.12.0 2.12.0.x
connect2id / nimbus_jose+jwt 1.8 1.8.x
connect2id / nimbus_jose+jwt 2.18 2.18.x
connect2id / nimbus_jose+jwt 4.15 4.15.x
connect2id / nimbus_jose+jwt 4.12 4.12.x
connect2id / nimbus_jose+jwt 4.2 4.2.x
connect2id / nimbus_jose+jwt 1.11 1.11.x
connect2id / nimbus_jose+jwt 3.8.2 3.8.2.x
connect2id / nimbus_jose+jwt 2.14 2.14.x
connect2id / nimbus_jose+jwt 1.2 1.2.x
connect2id / nimbus_jose+jwt 1.6 1.6.x
connect2id / nimbus_jose+jwt 4.36.1 4.36.1.x
connect2id / nimbus_jose+jwt 2.19.1 2.19.1.x
connect2id / nimbus_jose+jwt 2.3 2.3.x
connect2id / nimbus_jose+jwt 3.9.1 3.9.1.x
connect2id / nimbus_jose+jwt 2.23 2.23.x
connect2id / nimbus_jose+jwt 4.13 4.13.x
connect2id / nimbus_jose+jwt 4.14 4.14.x
connect2id / nimbus_jose+jwt 4.33 4.33.x
connect2id / nimbus_jose+jwt 4.37.1 4.37.1.x
connect2id / nimbus_jose+jwt 2.7 2.7.x
connect2id / nimbus_jose+jwt 4.11.1 4.11.1.x
connect2id / nimbus_jose+jwt 4.5 4.5.x
connect2id / nimbus_jose+jwt 3.2 3.2.x
connect2id / nimbus_jose+jwt 2.0.1 2.0.1.x
connect2id / nimbus_jose+jwt 2.9 2.9.x
connect2id / nimbus_jose+jwt 4.34.1 4.34.1.x
connect2id / nimbus_jose+jwt 3.1.2 3.1.2.x
connect2id / nimbus_jose+jwt 3.0 3.0.x
connect2id / nimbus_jose+jwt 2.26.1 2.26.1.x
connect2id / nimbus_jose+jwt 4.4 4.4.x
connect2id / nimbus_jose+jwt 2.0 2.0.x
connect2id / nimbus_jose+jwt 4.20 4.20.x
connect2id / nimbus_jose+jwt 3.2.2 3.2.2.x
connect2id / nimbus_jose+jwt 1.3 1.3.x
connect2id / nimbus_jose+jwt 4.23 4.23.x
connect2id / nimbus_jose+jwt 4.29 4.29.x
connect2id / nimbus_jose+jwt 4.30 4.30.x
connect2id / nimbus_jose+jwt 2.11.0 2.11.0.x
connect2id / nimbus_jose+jwt 3.9.2 3.9.2.x
connect2id / nimbus_jose+jwt 4.3.1 4.3.1.x
connect2id / nimbus_jose+jwt 4.16 4.16.x
connect2id / nimbus_jose+jwt 1.0 1.0.x
connect2id / nimbus_jose+jwt 2.21 2.21.x
connect2id / nimbus_jose+jwt 1.12 1.12.x
connect2id / nimbus_jose+jwt 4.16.2 4.16.2.x
connect2id / nimbus_jose+jwt 2.15 2.15.x
connect2id / nimbus_jose+jwt 2.15.1 2.15.1.x
connect2id / nimbus_jose+jwt 3.8 3.8.x
connect2id / nimbus_jose+jwt 4.26.1 4.26.1.x
connect2id / nimbus_jose+jwt 2.5 2.5.x
connect2id / nimbus_jose+jwt 4.15.1 4.15.1.x
connect2id / nimbus_jose+jwt 4.32 4.32.x
connect2id / nimbus_jose+jwt 4.22 4.22.x
connect2id / nimbus_jose+jwt 2.2 2.2.x
connect2id / nimbus_jose+jwt 2.13.1 2.13.1.x
connect2id / nimbus_jose+jwt 3.3 3.3.x
connect2id / nimbus_jose+jwt 2.26 2.26.x
connect2id / nimbus_jose+jwt 2.18.2 2.18.2.x
connect2id / nimbus_jose+jwt 3.8.1 3.8.1.x
connect2id / nimbus_jose+jwt 3.1.1 3.1.1.x
connect2id / nimbus_jose+jwt 4.25 4.25.x
connect2id / nimbus_jose+jwt 2.22.1 2.22.1.x
connect2id / nimbus_jose+jwt 4.31 4.31.x
connect2id / nimbus_jose+jwt 4.11 4.11.x
connect2id / nimbus_jose+jwt 4.11.2 4.11.2.x
connect2id / nimbus_jose+jwt 4.7 4.7.x
connect2id / nimbus_jose+jwt 4.18 4.18.x
connect2id / nimbus_jose+jwt 4.26 4.26.x
connect2id / nimbus_jose+jwt 3.9 3.9.x
connect2id / nimbus_jose+jwt 2.17.1 2.17.1.x
connect2id / nimbus_jose+jwt 2.8 2.8.x
connect2id / nimbus_jose+jwt 4.1 4.1.x
connect2id / nimbus_jose+jwt 4.0.1 4.0.1.x
connect2id / nimbus_jose+jwt 4.28 4.28.x
com.nimbusds / nimbus-jose-jwt - 4.39