CVE-2018-1000539 Json-jwt did not verify the cryptographic signature for data
Attackers can forge authentication tags in AES-GCM encrypted JSON Web Tokens, bypassing signature verification in the json-jwt Ruby library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1000539?
CVE-2018-1000539 is a medium-severity vulnerability in n/a, published on 26 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 1.9.4 and later.
Weakness: CWE-347
Which versions are affected by CVE-2018-1000539?
2 open source packages ship an affected version, including json-jwt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
json-jwt RubyGems | From 0.5.1 | 1.9.4 |
json-jwt RubyGems | From 0.5.1 | 1.9.4 |
Products include Json-Jwt Project Json-Jwt.
How do I fix CVE-2018-1000539?
Upgrade json-jwt to 1.9.4 or later.
Is CVE-2018-1000539 being exploited?
There is no known exploitation of CVE-2018-1000539 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as CVE-2018-3768, DEBIAN-CVE-2018-1000539, DSA-4283-1, GHSA-mj4x-wcxf-hm8x, UBUNTU-CVE-2018-1000539.