vulnwire
7.5high

CVE-2017-12974

Improper Verification of Cryptographic Signature in Nimbus JOSE+JWT

Also known as GHSA-pfv2-37f7-9m6w

Published 9 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.3%
percentile 70%
Public exploits
0
none known

Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows attackers to conduct an Invalid Curve Attack in environments where the JCE provider lacks the applicable curve validation.

Exploit prediction (EPSS)

1.26% probability of exploitation in the next 30 days, higher than 70% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

EcosystemPackageAffectedFixed in
mavencom.nimbusds:nimbus-jose-jwt
<4.36
4.36

Classification

Weakness
  • CWE-347 Improper Verification of Cryptographic Signature

References

  • bitbucket.org /connect2id/nimbus-jose-jwt/issues/217/explicit-check-for-ec-public-key-on-curve · x_refsource_CONFIRM, x_transferred
  • bitbucket.org /connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt · x_refsource_CONFIRM, x_transferred
  • bitbucket.org /connect2id/nimbus-jose-jwt/commits/f3a7a801f0c6b078899fed9226368eb7b44e2b2f · x_refsource_CONFIRM, x_transferred
  • lists.apache.org /thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.a · mailing-list, x_refsource_MLIST, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-12974 · advisory
  • github.com /felx/nimbus-jose-jwt · package
  • lists.apache.org /thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apa · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.