Vulnerability CVE-2017-12973
Published: 2017-08-20

Description:
Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackers to conduct a padding oracle attack.

Type:

CWE-354

 (Improper Validation of Integrity Check Value)

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
Connect2id -> Nimbus jose+jwt 

 References:
https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/6a29f10f723f406eb25555f55842c59a43a38912
https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/223/aescbc-return-immediately-on-invalid-hmac
https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt
Copyright 2024, cxsecurity.com

 

Back to Top