Withdrawn: JJWT improperly generates signing keys
## Withdrawn Advisory This advisory has been withdrawn because it has been found to be disputed. Please see the issue [here](https://github.com/jwtk/jjwt/issues/930#issuecomment-2032699358) for more information. ## Original Description JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-31033US | —OT erhöht | — | ||
JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method wi… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/2308652512/JJWT_BUGWEB
- https://github.com/jwtk/jjwtPACKAGE
- https://github.com/jwtk/jjwt/blob/26948610fbef81eba867cbaad54b516d1874c70a/impl/src/main/java/io/jsonwebtoken/impl/DefaultJwtParserBuilder.java#L242WEB
- https://github.com/jwtk/jjwt/issues/930#issuecomment-2032699358WEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-31033ADVISORY
- https://www.viralpatel.net/java-create-validate-jwt-tokenWEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan