Use of a broken or risky cryptographic algorithm in node-jsonwebtoken - CVE-2022-23540

Vulnerability identifier: #VU71182

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-23540

CWE-ID: CWE-327

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insecure default algorithm in jwt.verify(). A remote attacker can cause signature validation bypass.

node-jsonwebtoken
QRadar Suite
strapi
Event Streams
IBM Integration Bus
IBM Cloud Pak for Business Automation
Spectrum Discover
IBM Decision Optimization for Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
Data Replication on Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Maximo Application Suite
Automation Assets in IBM Cloud Pak for Integration (CP4I)
IBM Security Verify Information Queue
IBM Watson Machine Learning Accelerator
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
IBM App Connect Enterprise
OpenShift Data Foundation (formerly OpenShift Container Storage)
IBM Cognos Analytics

Install updates from vendor's website.

node-jsonwebtoken - update to 9.0.0
QRadar Suite - update to 1.10.18.0
strapi - update to 4.5.6
Event Streams - update to 11.1.4
IBM Security Verify Information Queue - update to 10.0.5
IBM App Connect Enterprise - update to 11.0.0.20
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.26, 23.0.1.4
Spectrum Discover - addressed in versions 2.0.4.8, 2.1.1
IBM Watson Machine Learning Accelerator - addressed in versions 2.2.6, 2.3.5, 3.1.0
IBM Decision Optimization for Cloud Pak for Data - update to 4.6.1
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.6.2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.3
Data Replication on Cloud Pak for Data - update to 4.6.5
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.13.0
App Connect Enterprise Certified Container - addressed in versions 5.0.3, 7.1.0
IBM Maximo Application Suite - addressed in versions 8.8.7, 8.9.3
IBM Cognos Analytics - addressed in versions 11.2.4 FP3, 12.0.3
Automation Assets in IBM Cloud Pak for Integration (CP4I) - update to 2022.2.1-5
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 2022.2.1-6, 2022.4.1-1

• Exploit #8751 - CVE-2022-23540-PoC (CVE-2022-23540 - jwt.verify() method) (January 19, 2023)

• https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6
• https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3

• Multiple vulnerabilities in node-jsonwebtoken
• Multiple vulnerabilities in strapi
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in IBM App Connect Enterprise and IBM Integration Bus
• Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Decision Optimization in IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Platform Navigator and Automation Assets in IBM Cloud Pak for Integration
• Multiple vulnerabilities in IBM Maximo Application Suite
• Multiple vulnerabilities in IBM Event Streams
• Multiple vulnerabilities in IBM Security Verify Information Queue
• Multiple vulnerabilities in IBM Spectrum Discover
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.13
• Multiple vulnerabilities in IBM Data Replication on Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM QRadar Suite Software
• Multiple vulnerabilities in IBM Cognos Analytics