CVE-2019-1010263 Auth bypass in Perl Crypt::JWT
Attackers can bypass authentication in Perl Crypt::JWT by crafting tokens with hmac(), requiring an upgrade to the fixed version.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-1010263?
CVE-2019-1010263 is a critical authentication bypass vulnerability in Perl Crypt::JWT, published on 17 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Perl Crypt::JWT prior to 0.023 is affected by: Incorrect Access Control. The impact is: allow attackers to bypass authentication by providing a token by crafting with hmac(). The component is: JWT.pm, line 614. The attack vector is: network connectivity. The fixed version is: after commit b98a59b42ded9f9e51b2560410106207c2152d6c.
Weakness: CWE-347
Which versions are affected by CVE-2019-1010263?
It affects 1 product.
Products include Perl Crypt\ \.
How do I fix CVE-2019-1010263?
No fix has been published for CVE-2019-1010263 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-1010263 being exploited?
There is no known exploitation of CVE-2019-1010263 in the wild and no public exploit code.
Sources
Also known as GHSA-54vx-xvq8-jh85, UBUNTU-CVE-2019-1010263.