CVE-2017-12973 - CVE House
Back to Database
Status published Low CVE-2017-12973

Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an...

Vulnerability Description

Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackers to conduct a padding oracle attack.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-12973

Credits & Attribution

No credits recorded in the NVD database.

References

More from connect2id

View All →
CVE-2019-17195
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions...
Critical 9.8
CVE-2017-12974
Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring...
High 7.5
CVE-2017-12972
In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check...
High 7.5

Affected Vendor

Affected Software

nimbus jose\+jwt
Vulnerable Versions:
1.0, 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.9.1, 1.10, 1.11, 1.12, 2.0, 2.0.1, 2.1, 2.1.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7, 2.8, 2.9, 2.10, 2.10.1, 2.11.0, 2.12.0, 2.13.0, 2.13.1, 2.14, 2.15, 2.15.1, 2.15.2, 2.16, 2.17, 2.17.1, 2.17.2, 2.18, 2.18.1, 2.18.2, 2.19, 2.19.1, 2.20, 2.21, 2.22, 2.22.1, 2.23, 2.24, 2.25, 2.26, 2.26.1, 3.0, 3.1, 3.1.1, 3.1.2, 3.2, 3.2.1, 3.2.2, 3.3, 3.4, 3.5, 3.6, 3.7, 3.8, 3.8.1, 3.8.2, 3.9, 3.9.1, 3.9.2, 3.10, 4.0, 4.0.1, 4.1, 4.1.1, 4.2, 4.3, 4.3.1, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 4.10, 4.11, 4.11.1, 4.11.2, 4.12, 4.13, 4.13.1, 4.14, 4.15, 4.15.1, 4.16, 4.16.1, 4.16.2, 4.17, 4.18, 4.19, 4.20, 4.21, 4.22, 4.23, 4.24, 4.25, 4.26, 4.26.1, 4.27, 4.27.1, 4.28, 4.29, 4.30, 4.31, 4.31.1, 4.32, 4.33, 4.34, 4.34.1, 4.34.2, 4.35, 4.36.1, 4.37, 4.37.1, 4.38

Timeline

Official Publish: August 20th, 2017
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.