Em resumo
- CVE-2021-46743 é uma vulnerabilidade CRÍTICO (CVSS 9.1) que afeta firebase/php-jwt, firebase php-jwt (google).
- Chance de exploração nos próximos 30 dias (EPSS): 0.92%, maior que 60.4% das vulnerabilidades.
- Correção: atualize para 6.0.0 ou posterior.
Description
In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. NOTE: this provides a straightforward way to use the PHP-JWT library unsafely, but might not be considered a vulnerability in the library itself.
NVD description
In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. NOTE: this provides a straightforward way to use the PHP-JWT library unsafely, but might not be considered a vulnerability in the library itself.
Mais vulnerabilidades de firebase/php-jwt
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free