Cryptographic issues in Nimbus JOSE+JWT - CVE-2017-12974
Published: January 10, 2020
Vulnerability identifier: #VU24177
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2017-12974
CWE-ID: CWE-310
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Connect2id Ltd.
Affected software:
Nimbus JOSE+JWT
Nimbus JOSE+JWT
Detailed vulnerability description
The vulnerability allows a remote attacker to conduct a padding oracle attack.
The vulnerability exists due to Nimbus JOSE+JWT proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve. A remote attacker can conduct an Invalid Curve Attack in environments where the JCE provider lacks the applicable curve validation.
How to mitigate CVE-2017-12974
Install updates from vendor's website.
Sources
- https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f3a7a801f0c6b078899fed9226368eb7b44e2b2f
- https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/217/explicit-check-for-ec-public-key-on-curve
- https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E