netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-c8v6-786g-vjx6

Browse Source
This commit is contained in:
advisory-database[bot]
2024-03-06 23:51:58 +00:00
parent 94d0b42f36
commit d9a1c88d91
1 changed files with 30 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/02/GHSA-c8v6-786g-vjx6/GHSA-c8v6-786g-vjx6.json
+30 -3
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c8v6-786g-vjx6",
"modified": "2024-03-04T20:16:01Z",
"modified": "2024-03-06T23:50:38Z",
"published": "2024-02-29T03:33:14Z",
"aliases": [
"CVE-2023-51774"
],
"summary": "json-jwt allows bypass of identity checks via a sign/encryption confusion attack",
"details": "The json-jwt (aka JSON::JWT) gem before 1.16.6 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode.",
"details": "The json-jwt (aka JSON::JWT) gem 1.16.x before 1.16.6, 1.15.x before 1.15.3.1 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode.",
"severity": [
],
@@ -22,7 +22,7 @@
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
"introduced": "1.16.0"
},
{
"fixed": "1.16.6"
@@ -30,6 +30,25 @@
]
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "json-jwt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.15.3.1"
}
]
}
]
}
],
"references": [
@@ -41,6 +60,14 @@
"type": "WEB",
"url": "https://github.com/nov/json-jwt/issues/120"
},
{
"type": "WEB",
"url": "https://github.com/nov/json-jwt/issues/121"
},
{
"type": "WEB",
"url": "https://github.com/nov/json-jwt/commit/593ea8bcaf2629048bad8c036191f2da0a2e713c"
},
{
"type": "WEB",
"url": "https://github.com/nov/json-jwt/commit/9c4d842a9465bd7960570ca326c3de79b4abc9d0"