Key management errors in Java JWT (JJWT) - CVE-2024-31033

Vulnerability identifier: #VU91688

CSH Severity: Medium

CVSS v4: 7.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-31033

CWE-ID: CWE-320

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. The vulnerability has unknown impact and attack vector.

Java JWT (JJWT)
Maximo Application Suite - Visual Inspection Component
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
IBM Cognos Controller
IBM Sterling Connect:Direct Web Services
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation

Install updates from vendor's website.

Maximo Application Suite - Visual Inspection Component - addressed in versions 8.9.21, 9.0.19, 9.1.12
IBM Cognos Controller - update to 11.1.2
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.1.1
IBM Sterling Connect:Direct Web Services - addressed in versions 6.1.0.25, 6.2.0.24, 6.3.0.9
IBM Business Automation Workflow - addressed in versions 21.0.3 IF033, 23.0.2 IF005
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.33, 23.0.2.5

• https://github.com/jwtk/jjwt
• https://www.viralpatel.net/java-create-validate-jwt-token/
• https://github.com/2308652512/JJWT_BUG
• https://github.com/jwtk/jjwt/issues/930#issuecomment-2032699358

• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Key management errors in IBM Business Automation Workflow
• Key management errors in IBM Sterling Connect:Direct Web Service
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for jwtk JJWT
• Multiple vulnerabilities in IBM Controller
• IBM Maximo Application Suite - Visual Inspection Component update for JJWT