1. Home
  2. Vulnerabilities
  3. CVE-2017-12972

CVE-2017-12972

CVSS v3.0 7.5 (High)
75% Progress
CVSS v2.0 5 (Medium)
50% Progress
EPSS 0.23 % (61th)
0.23% Progress
Affected Products 1
Advisories 1
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software Graph Web & Social Timeline

In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers to conduct HMAC bypass attacks by shifting Additional Authenticated Data (AAD) and ciphertext so that different plaintext is obtained for the same HMAC.

Weaknesses
CWE-345
Insufficient Verification of Data Authenticity
CVE Status
PUBLISHED
CNA
MITRE
Published Date
2017-08-20 16:29:00
(7 years ago)
Updated Date
2023-11-07 02:38:32
(10 months ago)

Affected Products

Connect2id

Configuration #1

    CPE23 From Up To
  Connect2id Nimbus Jose+jwt 1.0 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:1.0
  Connect2id Nimbus Jose+jwt 1.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:1.1
  Connect2id Nimbus Jose+jwt 1.2 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:1.2
  Connect2id Nimbus Jose+jwt 1.3 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:1.3
  Connect2id Nimbus Jose+jwt 1.4 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:1.4
  Connect2id Nimbus Jose+jwt 1.5 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:1.5
  Connect2id Nimbus Jose+jwt 1.6 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:1.6
  Connect2id Nimbus Jose+jwt 1.7 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:1.7
  Connect2id Nimbus Jose+jwt 1.8 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:1.8
  Connect2id Nimbus Jose+jwt 1.9 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:1.9
  Connect2id Nimbus Jose+jwt 1.9.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:1.9.1
  Connect2id Nimbus Jose+jwt 1.10 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:1.10
  Connect2id Nimbus Jose+jwt 1.11 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:1.11
  Connect2id Nimbus Jose+jwt 1.12 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:1.12
  Connect2id Nimbus Jose+jwt 2.0 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.0
  Connect2id Nimbus Jose+jwt 2.0.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.0.1
  Connect2id Nimbus Jose+jwt 2.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.1
  Connect2id Nimbus Jose+jwt 2.1.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.1.1
  Connect2id Nimbus Jose+jwt 2.2 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.2
  Connect2id Nimbus Jose+jwt 2.3 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.3
  Connect2id Nimbus Jose+jwt 2.4 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.4
  Connect2id Nimbus Jose+jwt 2.5 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.5
  Connect2id Nimbus Jose+jwt 2.6 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.6
  Connect2id Nimbus Jose+jwt 2.7 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.7
  Connect2id Nimbus Jose+jwt 2.8 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.8
  Connect2id Nimbus Jose+jwt 2.9 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.9
  Connect2id Nimbus Jose+jwt 2.10 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.10
  Connect2id Nimbus Jose+jwt 2.10.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.10.1
  Connect2id Nimbus Jose+jwt 2.11.0 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.11.0
  Connect2id Nimbus Jose+jwt 2.12.0 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.12.0
  Connect2id Nimbus Jose+jwt 2.13.0 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.13.0
  Connect2id Nimbus Jose+jwt 2.13.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.13.1
  Connect2id Nimbus Jose+jwt 2.14 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.14
  Connect2id Nimbus Jose+jwt 2.15 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.15
  Connect2id Nimbus Jose+jwt 2.15.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.15.1
  Connect2id Nimbus Jose+jwt 2.15.2 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.15.2
  Connect2id Nimbus Jose+jwt 2.16 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.16
  Connect2id Nimbus Jose+jwt 2.17 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.17
  Connect2id Nimbus Jose+jwt 2.17.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.17.1
  Connect2id Nimbus Jose+jwt 2.17.2 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.17.2
  Connect2id Nimbus Jose+jwt 2.18 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.18
  Connect2id Nimbus Jose+jwt 2.18.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.18.1
  Connect2id Nimbus Jose+jwt 2.18.2 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.18.2
  Connect2id Nimbus Jose+jwt 2.19 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.19
  Connect2id Nimbus Jose+jwt 2.19.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.19.1
  Connect2id Nimbus Jose+jwt 2.20 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.20
  Connect2id Nimbus Jose+jwt 2.21 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.21
  Connect2id Nimbus Jose+jwt 2.22 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.22
  Connect2id Nimbus Jose+jwt 2.22.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.22.1
  Connect2id Nimbus Jose+jwt 2.23 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.23
  Connect2id Nimbus Jose+jwt 2.24 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.24
  Connect2id Nimbus Jose+jwt 2.25 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.25
  Connect2id Nimbus Jose+jwt 2.26 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.26
  Connect2id Nimbus Jose+jwt 2.26.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:2.26.1
  Connect2id Nimbus Jose+jwt 3.0 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:3.0
  Connect2id Nimbus Jose+jwt 3.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:3.1
  Connect2id Nimbus Jose+jwt 3.1.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:3.1.1
  Connect2id Nimbus Jose+jwt 3.1.2 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:3.1.2
  Connect2id Nimbus Jose+jwt 3.2 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:3.2
  Connect2id Nimbus Jose+jwt 3.2.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:3.2.1
  Connect2id Nimbus Jose+jwt 3.2.2 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:3.2.2
  Connect2id Nimbus Jose+jwt 3.3 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:3.3
  Connect2id Nimbus Jose+jwt 3.4 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:3.4
  Connect2id Nimbus Jose+jwt 3.5 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:3.5
  Connect2id Nimbus Jose+jwt 3.6 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:3.6
  Connect2id Nimbus Jose+jwt 3.7 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:3.7
  Connect2id Nimbus Jose+jwt 3.8 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:3.8
  Connect2id Nimbus Jose+jwt 3.8.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:3.8.1
  Connect2id Nimbus Jose+jwt 3.8.2 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:3.8.2
  Connect2id Nimbus Jose+jwt 3.9 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:3.9
  Connect2id Nimbus Jose+jwt 3.9.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:3.9.1
  Connect2id Nimbus Jose+jwt 3.9.2 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:3.9.2
  Connect2id Nimbus Jose+jwt 3.10 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:3.10
  Connect2id Nimbus Jose+jwt 4.0 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.0
  Connect2id Nimbus Jose+jwt 4.0.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.0.1
  Connect2id Nimbus Jose+jwt 4.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.1
  Connect2id Nimbus Jose+jwt 4.1.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.1.1
  Connect2id Nimbus Jose+jwt 4.2 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.2
  Connect2id Nimbus Jose+jwt 4.3 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.3
  Connect2id Nimbus Jose+jwt 4.3.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.3.1
  Connect2id Nimbus Jose+jwt 4.4 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.4
  Connect2id Nimbus Jose+jwt 4.5 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.5
  Connect2id Nimbus Jose+jwt 4.6 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.6
  Connect2id Nimbus Jose+jwt 4.7 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.7
  Connect2id Nimbus Jose+jwt 4.8 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.8
  Connect2id Nimbus Jose+jwt 4.9 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.9
  Connect2id Nimbus Jose+jwt 4.10 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.10
  Connect2id Nimbus Jose+jwt 4.11 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.11
  Connect2id Nimbus Jose+jwt 4.11.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.11.1
  Connect2id Nimbus Jose+jwt 4.11.2 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.11.2
  Connect2id Nimbus Jose+jwt 4.12 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.12
  Connect2id Nimbus Jose+jwt 4.13 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.13
  Connect2id Nimbus Jose+jwt 4.13.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.13.1
  Connect2id Nimbus Jose+jwt 4.14 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.14
  Connect2id Nimbus Jose+jwt 4.15 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.15
  Connect2id Nimbus Jose+jwt 4.15.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.15.1
  Connect2id Nimbus Jose+jwt 4.16 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.16
  Connect2id Nimbus Jose+jwt 4.16.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.16.1
  Connect2id Nimbus Jose+jwt 4.16.2 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.16.2
  Connect2id Nimbus Jose+jwt 4.17 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.17
  Connect2id Nimbus Jose+jwt 4.18 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.18
  Connect2id Nimbus Jose+jwt 4.19 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.19
  Connect2id Nimbus Jose+jwt 4.20 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.20
  Connect2id Nimbus Jose+jwt 4.21 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.21
  Connect2id Nimbus Jose+jwt 4.22 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.22
  Connect2id Nimbus Jose+jwt 4.23 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.23
  Connect2id Nimbus Jose+jwt 4.24 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.24
  Connect2id Nimbus Jose+jwt 4.25 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.25
  Connect2id Nimbus Jose+jwt 4.26 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.26
  Connect2id Nimbus Jose+jwt 4.26.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.26.1
  Connect2id Nimbus Jose+jwt 4.27 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.27
  Connect2id Nimbus Jose+jwt 4.27.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.27.1
  Connect2id Nimbus Jose+jwt 4.28 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.28
  Connect2id Nimbus Jose+jwt 4.29 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.29
  Connect2id Nimbus Jose+jwt 4.30 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.30
  Connect2id Nimbus Jose+jwt 4.31 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.31
  Connect2id Nimbus Jose+jwt 4.31.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.31.1
  Connect2id Nimbus Jose+jwt 4.32 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.32
  Connect2id Nimbus Jose+jwt 4.33 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.33
  Connect2id Nimbus Jose+jwt 4.34 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.34
  Connect2id Nimbus Jose+jwt 4.34.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.34.1
  Connect2id Nimbus Jose+jwt 4.34.2 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.34.2
  Connect2id Nimbus Jose+jwt 4.35 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.35
  Connect2id Nimbus Jose+jwt 4.36.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.36.1
  Connect2id Nimbus Jose+jwt 4.37 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.37
  Connect2id Nimbus Jose+jwt 4.37.1 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.37.1
  Connect2id Nimbus Jose+jwt 4.38 cpe:2.3:a:connect2id:nimbus_jose\%2bjwt:4.38