Skip to content
Fencer Intel
high —

GHSA-hxhc-wmg8-xrqf json

namshi/jose insecure JSON Web Signatures (JWS)

published 2y ago modified last yr.

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

namshi/jose allows the acceptance of unsecure JSON Web Signatures (JWS) by default. The vulnerability arises from the $allowUnsecure flag, which, when set to true during the loading of JWSes, permits tokens signed with 'none' algorithms to be processed. This behavior poses a significant security risk as it could allow an attacker to impersonate users by crafting a valid jwt token.

Patch / fix

  • packagist namshi/jose 1.1.2, 1.2.2, 2.0.3, 2.1.2

Is GHSA-hxhc-wmg8-xrqf in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
packagist namshi/jose
<1.1.2
>=1.2.0, <1.2.2
>=2.0.0, <2.0.3
>=2.1.0, <2.1.2
1.1.2
1.2.2
2.0.3
2.1.2

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.