CVE-2019-17195 Improper Check for Unusual or Exceptional Conditions in Connect2id Nimbus JOSE+JWT
Attackers can cause application crashes or bypass authentication by sending malformed JWTs to applications using the Nimbus JOSE+JWT library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-17195?
CVE-2019-17195 is a critical denial of service vulnerability in Oracle Enterprise Manager Base Platform, published on 15 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.
Weakness: CWE-755
Which versions are affected by CVE-2019-17195?
2 open source packages ship an affected version, including com.nimbusds:nimbus-jose-jwt. It affects 15 products.
| Package | Affected | Fixed in |
|---|---|---|
com.nimbusds:nimbus-jose-jwt Maven | All versions | 7.9 |
com.nimbusds:nimbus-jose-jwt Maven | All versions | 7.9 |
Products include Apache Hadoop, Connect2id Nimbus Jose\+jwt, Oracle Communications Cloud Native Core Security Edge Protection Proxy, Oracle Communications Pricing Design Center, Oracle Data Integrator, Oracle Enterprise Manager Base Platform and 9 more.
How do I fix CVE-2019-17195?
Upgrade com.nimbusds:nimbus-jose-jwt to 7.9 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-17195 being exploited?
There is no known exploitation of CVE-2019-17195 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Oracle Enterprise Manager Base Platform
- CVE-2022-25168 Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar
- CVE-2021-37404 Heap buffer overflow in libhdfs native library
- CVE-2022-26612 Arbitrary file write in FileUtil#unpackEntries on Windows
- CVE-2017-15718 Exposure of Sensitive Information in Hadoop
- CVE-2012-4449 Use of a Broken or Risky Cryptographic Algorithm in Apache Hadoop
Sources
Also known as CLEANSTART-2026-EQ87084, GHSA-f6vf-pq8c-69m4, OESA-2021-1269.