Withdrawn: JJWT improperly generates signing keys
## Withdrawn Advisory This advisory has been withdrawn because it has been found to be disputed. Please see the issue [here](https://github.com/jwtk/jjwt/issues/930#issuecomment-2032699358) for more information. ## Original Description JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-31033US | —OT elevated | — | ||
JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method wi… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/2308652512/JJWT_BUGWEB
- https://github.com/jwtk/jjwtPACKAGE
- https://github.com/jwtk/jjwt/blob/26948610fbef81eba867cbaad54b516d1874c70a/impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtParserBuilder.java#L242WEB
- https://github.com/jwtk/jjwt/issues/930#issuecomment-2032699358WEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-31033ADVISORY
- https://www.viralpatel.net/java-create-validate-jwt-tokenWEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan