Vulnerability Details CVE-2017-18239
A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt (aka com.jason-goodwin/authentikat-jwt) version 0.4.5 and earlier allows the supplier of a JWT token to guess bit after bit of the signature by repeating validation requests.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 61.0%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 5.0
References
- https://github.com/jasongoodwin/authentikat-jwt/commit/2d2fa0d40ac8f2f7aa7e9b070fa1a25eee082cb0
- https://github.com/jasongoodwin/authentikat-jwt/issues/12
- https://github.com/jasongoodwin/authentikat-jwt/pull/36
- https://github.com/jasongoodwin/authentikat-jwt/commit/2d2fa0d40ac8f2f7aa7e9b070fa1a25eee082cb0
- https://github.com/jasongoodwin/authentikat-jwt/issues/12
- https://github.com/jasongoodwin/authentikat-jwt/pull/36
Products affected by CVE-2017-18239
-
cpe:2.3:a:authentikat-jwt_project:authentikat-jwt:0.3.1
-
cpe:2.3:a:authentikat-jwt_project:authentikat-jwt:0.3.3
-
cpe:2.3:a:authentikat-jwt_project:authentikat-jwt:0.3.5
-
cpe:2.3:a:authentikat-jwt_project:authentikat-jwt:0.4.0
-
cpe:2.3:a:authentikat-jwt_project:authentikat-jwt:0.4.1
-
cpe:2.3:a:authentikat-jwt_project:authentikat-jwt:0.4.3
-
cpe:2.3:a:authentikat-jwt_project:authentikat-jwt:0.4.4
-
cpe:2.3:a:authentikat-jwt_project:authentikat-jwt:0.4.5