CVE-2022-23541 (Medium) detected in jsonwebtoken-8.3.0.tgz
mend-bolt-for-github opened this issue · comments
CVE-2022-23541 - Medium Severity Vulnerability
Vulnerable Library - jsonwebtoken-8.3.0.tgz
JSON Web Token implementation (symmetric and asymmetric)
Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.3.0.tgz
Path to dependency file: /Section34-37-Warbler-Final-Project/warbler/warbler-server/package.json
Path to vulnerable library: /Section34-37-Warbler-Final-Project/warbler/warbler-server/node_modules/jsonwebtoken/package.json
Dependency Hierarchy:
- ❌ jsonwebtoken-8.3.0.tgz (Vulnerable Library)
Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4
Found in base branch: master
Vulnerability Details
jsonwebtoken is an implementation of JSON Web Tokens. Versions <= 8.5.1
of jsonwebtoken
library can be misconfigured so that passing a poorly implemented key retrieval function referring to the secretOrPublicKey
argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.
Publish Date: 2022-12-22
URL: CVE-2022-23541
CVSS 3 Score Details (6.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: GHSA-hjrf-2m68-5959
Release Date: 2022-12-22
Fix Resolution: 9.0.0
Step up your Open Source Security Game with Mend here