CVE-2017-10862 Insufficient Data Verification in io.really:jwt-scala
Attackers can bypass authentication by submitting crafted JWTs that are incorrectly verified as valid signatures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-10862?
CVE-2017-10862 is a medium-severity authentication bypass vulnerability in reallyl IO jwt-scala, published on 12 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
jwt-scala 1.2.2 and earlier fails to verify token signatures correctly which may lead to an attacker being able to pass specially crafted JWT data as a correctly signed token.
Weakness: CWE-345
Which versions are affected by CVE-2017-10862?
2 open source packages ship an affected version, including io.really:jwt-scala. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.really:jwt-scala Maven | All versions to 1.2.2 | None |
io.really:jwt-scala Maven | All versions to 1.2.2 | None |
Products include Really Jwt-Scala.
How do I fix CVE-2017-10862?
No fix has been published for CVE-2017-10862 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2017-10862 being exploited?
There is no known exploitation of CVE-2017-10862 in the wild and no public exploit code.
Sources
Also known as GHSA-9pxm-8g95-q5xr.