jose project jose vulnerabilities and exploits

(subscribe to this query)

JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named ...

Jose Project Jose

jose-php prior to 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote malicious users to obtain sensitive information via a timing attack, related to JWE.php and JWS.php.

Jose-php Project Jose-php

The RSA 1.5 algorithm implementation in the JOSE_JWE class in JWE.php in jose-php prior to 2.2.1 lacks the Random Filling protection mechanism, which makes it easier for remote malicious users to obtain cleartext data via a Million Message Attack (MMA).

Jose-php Project Jose-php

The PHP JOSE Library by Gree Inc. before version 2.2.1 is vulnerable to key confusion/algorithm substitution in the JWS component resulting in bypassing the signature verification via crafted tokens.

Php Jose Project Php Jose

4 Github repositories

python-jose prior to 1.3.2 allows malicious users to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys.

Python-jose Project Python-jose

go-jose prior to 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the rec...

Go-jose Project Go-jose

go-jose prior to 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For examp...

Go-jose Project Go-jose

go-jose prior to 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures.

Go-jose Project Go-jose

reason-jose is a JOSE implementation in ReasonML and OCaml.`Jose.Jws.validate` does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks. Such tampering could expose applications using reason-jose to au...

Reason-jose Project Reason-jose

jose-node-cjs-runtime is an npm package which provides a number of cryptographic functions. In versions before 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if ei...

Jose-node-cjs-runtime Project Jose-node-cjs-runtime

1 2 3 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook