Vulnerabilities

TI-2023-28402 CVE-2023-51774 · GHSA-c8v6-786g-vjx6

The json-jwt (aka JSON::JWT) gem 1.16.3 for Ruby sometimes allows bypass of identity…

HIGH 72

The json-jwt (aka JSON::JWT) gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack.

CVSS 3.1HIGH 8.4 Local No auth No interaction EPSS 0.00231 Published 2023-12-25 Fixed in 1.16.6, 1.15.3.1 CWE-284

TI-2019-13583 CVE-2019-18848 · GHSA-cff7-6h4q-q5pj

The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.

LOW 35

The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01257 Published 2019-11-12 Fixed in 1.11.0 CWE-287

TI-2018-15937 CVE-2018-1000539 · GHSA-mj4x-wcxf-hm8x

Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of…

LOW 25

Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authe…

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.00765 Published 2018-06-26 Fixed in 1.9.4 CWE-347

Vulnerabilities

Filters

The json-jwt (aka JSON::JWT) gem 1.16.3 for Ruby sometimes allows bypass of identity…

The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.

Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of…