Json-jwt did not verify the cryptographic signature for data

中 5.3CVE-2018-1000539 · GHSA-mj4x-wcxf-hm8x · 26/06/2018 公開 · 17/06/2026 更新

要点

CVE-2018-1000539 は json-jwt, json-jwt (json-jwt project) に影響する深刻度「中」 (CVSS 5.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.77%（全脆弱性の 55.6% より高い）。
対処：1.9.4 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
json-jwt RubyGems	`≥ 0.5.1, < 1.9.4`	`1.9.4`
json-jwt json-jwt_project	`≥ 0.5.0, < 1.9.4`	`1.9.4`

概要

The json-jwt rubygem version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 1.9.4 and later.

NVD の説明

Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 1.9.4 and later.