CVE-2017-18239
Critical
Description
A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt (aka com.jason-goodwin/authentikat-jwt) version 0.4.5 and earlier allows the supplier of a JWT token to guess bit after bit of the signature by repeating validation requests.
SeverityCritical
CVSS9.8
Exploit probability—
ProductAuthentikat-jwt
PublishedMar 18, 2018
First seenMar 18, 2018
How to fix
Update
- com.jason-goodwin:authentikat-jwt_2.120.4.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| authentikat-jwt_project authentikat-jwt | v ≤ 0.4.5 | — |
| com.jason-goodwin:authentikat-jwt_2.12Maven | v < 0.4.6 | 0.4.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.