Read the docs
TI-2019-12818 Aliases CVE-2019-17195GHSA-f6vf-pq8c-69m4

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while…

Priority MEDIUM 55CWE-755Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.

Why it matters now

EPSS 0.11121 95th percentileScored 2026-11-07
Fix Fixed com.nimbusds:nimbus-jose-jwt (Maven): 7.9Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.nimbusds:nimbus-jose-jwt (Maven)before 7.97.9Patch availableGHSA-f6vf-pq8c-69m4
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.nimbusds:nimbus-jose-jwt (Maven) Vendor— Affected before 7.9 Fixed in 7.9 Patch available GHSA-f6vf-pq8c-69m4

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:connect2id:nimbus_jose\+jwt:*:*:*:*:*:*:*:*before 7.9VulnerableConnect2id
cpe:2.3:a:apache:hadoop:3.2.1:-:*:*:*:*:*:*3.2.1VulnerableApache
cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:*1.7.0VulnerableOracle
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*12.0.0.3.0VulnerableOracle
cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*13.4.0.0VulnerableOracle
cpe:2.3:a:oracle:healthcare_data_repository:8.1.0:*:*:*:*:*:*:*8.1.0VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:*11.0 – 11.3.1VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*up to 9.2.5.3VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*up to 9.2.5.3VulnerableOracle
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:*:*:*:*:*:*:*:* Versions before 7.9 Vulnerable ·Connect2id
  • cpe:2.3:a:apache:hadoop:3.2.1:-:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·Apache
  • cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:* Versions 1.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:* Versions 13.4.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:healthcare_data_repository:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:* Versions 11.0 – 11.3.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:* Versions up to 9.2.5.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* Versions up to 9.2.5.3 Vulnerable ·Oracle
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*8.58VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*8.59VulnerableOracle
cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:*12.2.0 – 12.2.22VulnerableOracle
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*18.8.0 – 18.8.11VulnerableOracle
cpe:2.3:a:oracle:primavera_gateway:19.12.0:*:*:*:*:*:*:*19.12.0VulnerableOracle
cpe:2.3:a:oracle:solaris_cluster:4.0:*:*:*:*:*:*:*4.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* Versions 8.59 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:* Versions 12.2.0 – 12.2.22 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* Versions 18.8.0 – 18.8.11 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_gateway:19.12.0:*:*:*:*:*:*:* Versions 19.12.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:solaris_cluster:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-f6vf-pq8c-69m4 com.nimbusds:nimbus-jose-jwt (Maven) Fixed in 7.9 Advisory →

Red Hat 1 advisory

  • RHSA-2020:1308 Released 2020-04-02 · Red Hat rating Low
    Red Hat Virtualization Engine security, bug fix 4.3.9
    • RHV-M 4.3 ovirt-engine-4.3.9.3-0.1.el7, ovirt-engine-backend-4.3.9.3-0.1.el7, ovirt-engine-dbscripts-4.3.9.3-0.1.el7 +21
    • Tools for RHV Engine apache-commons-beanutils-1.8.3-15.el7_7, apache-commons-beanutils-javadoc-1.8.3-15.el7_7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHV-M 4.3Fixed RHSA-2020:1308
Tools for RHV EngineFixed RHSA-2020:1308

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-17195
  2. 2026-10-03 Alias added: GHSA-f6vf-pq8c-69m4

References

Patch 6

Advisory 3

Other 16

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences