Use of a broken or risky cryptographic algorithm in node-jsonwebtoken - CVE-2022-23541

Vulnerability identifier: #VU71181

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-23541

CWE-ID: CWE-327

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insecure implementation of key retrieval function. A remote user attacker can cause successful validation of forged tokens.

node-jsonwebtoken
QRadar Suite
strapi
Event Streams
IBM Integration Bus
IBM Cloud Pak for Business Automation
Spectrum Discover
IBM Decision Optimization for Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
Data Replication on Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Maximo Application Suite
Automation Assets in IBM Cloud Pak for Integration (CP4I)
IBM Security Verify Information Queue
IBM Watson Machine Learning Accelerator
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
IBM App Connect Enterprise
OpenShift Data Foundation (formerly OpenShift Container Storage)
Operational Decision Manager
IBM Cognos Analytics

Install updates from vendor's website.

node-jsonwebtoken - update to 9.0.0
QRadar Suite - update to 1.10.18.0
strapi - update to 4.5.6
Event Streams - update to 11.1.4
IBM Security Verify Information Queue - update to 10.0.5
IBM App Connect Enterprise - update to 11.0.0.20
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.26, 23.0.1.4
Spectrum Discover - addressed in versions 2.0.4.8, 2.1.1
IBM Watson Machine Learning Accelerator - addressed in versions 2.2.6, 2.3.5, 3.1.0
IBM Decision Optimization for Cloud Pak for Data - update to 4.6.1
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.6.2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.3
Data Replication on Cloud Pak for Data - update to 4.6.5
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.13.0
App Connect Enterprise Certified Container - addressed in versions 5.0.3, 7.1.0
IBM Maximo Application Suite - addressed in versions 8.8.7, 8.9.3
Operational Decision Manager - addressed in versions 8.10.5.2 Interim fix 1, 8.11.0.1 Interim fix 30, 8.11.1 Interim fix 24, 8.12.0.1 Interim fix 5
IBM Cognos Analytics - addressed in versions 11.2.4 FP3, 12.0.3
Automation Assets in IBM Cloud Pak for Integration (CP4I) - update to 2022.2.1-5
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 2022.2.1-6, 2022.4.1-1

• https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
• https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0
• https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3

• Multiple vulnerabilities in node-jsonwebtoken
• Multiple vulnerabilities in strapi
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in IBM App Connect Enterprise and IBM Integration Bus
• Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Decision Optimization in IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Platform Navigator and Automation Assets in IBM Cloud Pak for Integration
• Multiple vulnerabilities in IBM Maximo Application Suite
• Multiple vulnerabilities in IBM Event Streams
• Multiple vulnerabilities in IBM Security Verify Information Queue
• Multiple vulnerabilities in IBM Spectrum Discover
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.13
• Multiple vulnerabilities in IBM Data Replication on Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM QRadar Suite Software
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in IBM Operational Decision Manager