CVE-2024-31033
JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key.
Does this matter?
Lower severity and a low EPSS score (0.78%). Track it; it rarely justifies an emergency change on its own.
Description
JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class. NOTE: the vendor disputes this because the "ignores" behavior cannot occur (in any version) unless there is a user error in how JJWT is used, and because the version that was actually tested must have been more than six years out of date.
- CVSS 3.1
- 6.8 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- EPSS
- 0.78% probability · 54th percentile
- CISA KEV
- Not listed
- Source
- cve@mitre.org
References
- https://github.com/2308652512/JJWT_BUG
- https://github.com/jwtk/jjwt
- https://github.com/jwtk/jjwt/issues/930#issuecomment-2032699358
- https://www.viralpatel.net/java-create-validate-jwt-token/
- https://github.com/2308652512/JJWT_BUG
- https://github.com/jwtk/jjwt
- https://github.com/jwtk/jjwt/issues/930#issuecomment-2032699358
- https://www.viralpatel.net/java-create-validate-jwt-token/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.