MEDIUM5.3

GHSA-mj4x-wcxf-hm8x

Json-jwt did not verify the cryptographic signature for data

Quick fix

GHSA-mj4x-wcxf-hm8x — json-jwt: upgrade to the fixed version with the command below.

bundle update json-jwt

Details

The json-jwt rubygem version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 1.9.4 and later.

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/json-jwt

Introduced in: 0.5.1Fixed in: 1.9.4

Fixbundle update json-jwt

References

https://nvd.nist.gov/vuln/detail/CVE-2018-1000539[ADVISORY]
https://github.com/nov/json-jwt/pull/62[WEB]
https://github.com/nov/json-jwt/commit/a3b2147f0f6d9aca653e7a30e453d3a92b33413f[WEB]
https://github.com/nov/json-jwt[PACKAGE]
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/json-jwt/CVE-2018-1000539.yml[WEB]
https://www.debian.org/security/2018/dsa-4283[WEB]