nov/json-jwt

nov/json-jwt

Releases98

Frequency1 month 3 weeks

Last Release 18 days ago

Stars298

JSON Web Token and its family (JSON Web Signature, JSON Web Encryption and JSON Web Key) in Ruby

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2019-18848 ↗	Nov 12, 2019Tuesday, 12 November 2019, 15:15	7.5 HIGH	5 MEDIUM
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.
CVE-2018-1000539 ↗	Jun 26, 2018Tuesday, 26 June 2018, 16:29	—	5 MEDIUM
Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 1.9.4 and later.