CVE-2019-18848 JSON-jwt Gem lacked element count during splitting of JWE string
Attackers can bypass authentication in the json-jwt Ruby gem by exploiting a missing element count check during JWE string splitting.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-18848?
CVE-2019-18848 is a high-severity authentication bypass vulnerability in Debian Debian Linux, published on 12 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.
Weakness: CWE-287
Which versions are affected by CVE-2019-18848?
2 open source packages ship an affected version, including json-jwt. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
json-jwt RubyGems | All versions | 1.11.0 |
json-jwt RubyGems | All versions | 1.11.0 |
Products include Debian Debian Linux, Json-Jwt Project Json-Jwt.
How do I fix CVE-2019-18848?
Upgrade json-jwt to 1.11.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-18848 being exploited?
There is no known exploitation of CVE-2019-18848 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2019-18848, DLA-2390-1, GHSA-cff7-6h4q-q5pj, UBUNTU-CVE-2019-18848.