Invalid Curve Attack in node-jose
Affected versions of `node-jose` are vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) is used. [Proof of Concept](https://gist.github.com/asanso/fa25685348051ef6a28d49aa0f27a4ae) ## Recommendation Update to version 0.9.3 or later.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-16007US | medium5.9 | — | ||
node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 i… | ||||
02
references
External citations — patches, advisories, analysis.
- http://blog.intothesymmetry.com/2017/03/critical-vulnerability-in-json-web.htmlWEB
- https://gist.github.com/asanso/fa25685348051ef6a28d49aa0f27a4aeWEB
- https://github.com/cisco/node-josePACKAGE
- https://github.com/cisco/node-jose/commit/f92cffb4a0398b4b1158be98423369233282e0afWEB
- https://github.com/cisco/node-jose/compare/0.9.2...0.9.3WEB
- https://github.com/cisco/node-jose/pull/88WEB
- https://nvd.nist.gov/vuln/detail/CVE-2017-16007ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan