Back to Database
Status published
High
CVE-2017-12972
In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check...
Vulnerability Description
In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers to conduct HMAC bypass attacks by shifting Additional Authenticated Data (AAD) and ciphertext so that different plaintext is obtained for the same HMAC.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-12972
Credits & Attribution
No credits recorded in the NVD database.
References
- https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/224/byte-to-bit-overflow-in-cbc
- https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/0d2bd649ea386539220d4facfe1f65eb1dadb86c
- https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
More from connect2id
View All →CVE-2019-17195
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions...
Critical
9.8
CVE-2017-12974
Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring...
High
7.5
CVE-2017-12973
Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an...
Low
3.1
Affected Vendor
connect2id
View all reports →Affected Software
nimbus jose\+jwt
Vulnerable Versions:
1.0, 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.9.1, 1.10, 1.11, 1.12, 2.0, 2.0.1, 2.1, 2.1.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7, 2.8, 2.9, 2.10, 2.10.1, 2.11.0, 2.12.0, 2.13.0, 2.13.1, 2.14, 2.15, 2.15.1, 2.15.2, 2.16, 2.17, 2.17.1, 2.17.2, 2.18, 2.18.1, 2.18.2, 2.19, 2.19.1, 2.20, 2.21, 2.22, 2.22.1, 2.23, 2.24, 2.25, 2.26, 2.26.1, 3.0, 3.1, 3.1.1, 3.1.2, 3.2, 3.2.1, 3.2.2, 3.3, 3.4, 3.5, 3.6, 3.7, 3.8, 3.8.1, 3.8.2, 3.9, 3.9.1, 3.9.2, 3.10, 4.0, 4.0.1, 4.1, 4.1.1, 4.2, 4.3, 4.3.1, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 4.10, 4.11, 4.11.1, 4.11.2, 4.12, 4.13, 4.13.1, 4.14, 4.15, 4.15.1, 4.16, 4.16.1, 4.16.2, 4.17, 4.18, 4.19, 4.20, 4.21, 4.22, 4.23, 4.24, 4.25, 4.26, 4.26.1, 4.27, 4.27.1, 4.28, 4.29, 4.30, 4.31, 4.31.1, 4.32, 4.33, 4.34, 4.34.1, 4.34.2, 4.35, 4.36.1, 4.37, 4.37.1, 4.38
Timeline
Official Publish:
August 20th, 2017
Last Modified:
August 5th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.