Vulnerability · Published Feb 1, 2023 · Assigned by GitHub_M

CVE-2023-23928reason-jose ignores signature checks

Medium 5.9

In plain English

A medium-severity security flaw in reason-jose from ulrikstrid. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.5%top 60.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

reason-jose is a JOSE implementation in ReasonML and OCaml.`Jose.Jws.validate` does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks. Such tampering could expose applications using reason-jose to authorization bypass. Applications relying on JWS claims assertion to enforce security boundaries may be vulnerable to privilege escalation. This issue has been patched in version 0.8.2.

Affected products (as reported)

Vendor	Product	Versions
ulrikstrid	reason-jose	< 0.8.2

Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

References

https://github.com/ulrikstrid/reason-jose/security/advisories/GHSA-7jj9-6qwv-wpm7 x_refsource_CONFIRM
https://github.com/ulrikstrid/reason-jose/commit/36cd724db3cbec121757624da49072386bd869e5 x_refsource_MISC
https://github.com/ulrikstrid/reason-jose/releases/tag/v0.8.2 x_refsource_MISC