Vulnerability · Published Apr 1, 2024 · Assigned by mitre
CVE-2024-31033
Medium 6.8
In plain English
A medium-severity security flaw in the io.jsonwebtoken:jjwt-impl package (Maven). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Official description
JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class. NOTE: the vendor disputes this because the "ignores" behavior cannot occur (in any version) unless there is a user error in how JJWT is used, and because the version that was actually tested must have been more than six years out of date.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | io.jsonwebtoken:jjwt-impl | no fix listed | GHSA-r65j-6h5f-4f92 |