CVE-2016-7037

The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function for hash comparison, which allows attackers to spoof signatures via a timing attack.
References
Link Resource
https://github.com/emarref/jwt/releases/tag/1.0.3 Issue Tracking Patch Third Party Advisory
https://github.com/emarref/jwt/pull/20 Issue Tracking Patch Third Party Advisory
http://www.securityfocus.com/bid/95847
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

cpe:2.3:a:jwt_project:jwt:*:*:*:*:*:*:*:*

Information

Published : 2017-01-23 13:59

Updated : 2017-01-31 18:59


NVD link : CVE-2016-7037

Mitre link : CVE-2016-7037


JSON object : View

CWE
CWE-361

7PK - Time and State

Advertisement

dedicated server usa

Products Affected

jwt_project

  • jwt