CVE-2017-12973

moderate-risk
Published 2017-08-20

Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackers to conduct a padding oracle attack.

Do I need to act?

-
0.23% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.1/10 Low
NETWORK / HIGH complexity

Affected Products (20)

Nimbus Jose\+Jwt
Nimbus Jose\+Jwt
Nimbus Jose\+Jwt
Nimbus Jose\+Jwt
Nimbus Jose\+Jwt
Nimbus Jose\+Jwt
Nimbus Jose\+Jwt
Nimbus Jose\+Jwt
Nimbus Jose\+Jwt
Nimbus Jose\+Jwt
Nimbus Jose\+Jwt
Nimbus Jose\+Jwt
Nimbus Jose\+Jwt
Nimbus Jose\+Jwt
Nimbus Jose\+Jwt
Nimbus Jose\+Jwt
Nimbus Jose\+Jwt
Nimbus Jose\+Jwt
Nimbus Jose\+Jwt
Nimbus Jose\+Jwt

Affected Vendors

Connect2Id

References (6)

Patch https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/6a29f10f723f406eb25555f...
Third Party Advisory https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/223/aescbc-return-immedi...
Release Notes https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt
Patch https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/6a29f10f723f406eb25555f...
Third Party Advisory https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/223/aescbc-return-immedi...
Release Notes https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt
44
/ 100
moderate-risk
Severity 11/34 · Low
Exploitability 1/34 · Minimal
Exposure 32/34 · Critical