Integer overflow in Nimbus JOSE+JWT - CVE-2017-12972
Published: January 10, 2020
Vulnerability identifier: #VU24175
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-12972
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to integer overflow when converting length values from bytes to bits in Nimbus JOSE+JWT. A remote attacker can shift Additional Authenticated Data (AAD) and ciphertext so that different plaintext is obtained for the same HMAC, trigger integer overflow and bypass HMAC authentication.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Nimbus JOSE+JWT
IBM PureData System for Operational Analytics
IBM Engineering Requirements Management DOORS Next
IBM PureData System for Operational Analytics
IBM Engineering Requirements Management DOORS Next
How to mitigate CVE-2017-12972
Install updates from vendor's website.
Nimbus JOSE+JWT - update to 4.39
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.11
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.11
External References
- https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/0d2bd649ea386539220d4facfe1f65eb1dadb86c
- https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/224/byte-to-bit-overflow-in-cbc
- https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E