| Package | Affected versions | Patched versions |
|---|---|---|
| net.gleske:jervis | < 2.2 | 2.2 |
| jervis | < 2.2 | 2.2 |
The code doesn't validate that the JWT header specifies "alg":"RS256".
Depending on the broader system, this could allow JWT forgery.
Internally this severity is low since JWT is only intended to interface with GitHub. External users should consider severity moderate.
Jervis patch will explicitly verify the algorithm in the header matches expectations and further verify the JWT structure.
Upgrade to Jervis 2.2.
External users should consider using an alternate JWT library or upgrade.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free