Django REST framework

Lookup for vulnerable packages by Package URL.

Purl pkg:npm/jwt-simple@0.5.3

Type npm

Namespace

Name jwt-simple

Version 0.5.3

Qualifiers

Subpath

Is_vulnerable false

Next_non_vulnerable_version null

Latest_non_vulnerable_version null

Affected_by_vulnerabilities

Fixing_vulnerabilities

url VCID-mtzj-rqrc-syas

vulnerability_id VCID-mtzj-rqrc-syas

summary

Signature Verification Bypass in jwt-simple
Versions of `jwt-simple` prior to 0.5.3 are vulnerable to Signature Verification Bypass. If no algorithm is specified in the `decode()` function, the packages uses the algorithm in the JWT to decode tokens. This allows an attacker to create a HS256 (symmetric algorithm) JWT with the server's public key as secret, and the package will verify it as HS256 instead of RS256 (asymmetric algorithm).


## Recommendation

Upgrade to version 0.5.3 or later.

references

reference_url	https://github.com/hokaccha/node-jwt-simple/commit/ead36e1d687645da9c3be8befdaaef622ea33106
reference_id
reference_type
scores
url	https://github.com/hokaccha/node-jwt-simple/commit/ead36e1d687645da9c3be8befdaaef622ea33106

reference_url	https://www.npmjs.com/advisories/831
reference_id
reference_type
scores
url	https://www.npmjs.com/advisories/831

reference_url	https://github.com/advisories/GHSA-8v5f-hp78-jgxq
reference_id	GHSA-8v5f-hp78-jgxq
reference_type
scores
url	https://github.com/advisories/GHSA-8v5f-hp78-jgxq

fixed_packages

url	pkg:npm/jwt-simple@0.5.3
purl	pkg:npm/jwt-simple@0.5.3
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:npm/jwt-simple@0.5.3

aliases GHSA-8v5f-hp78-jgxq, GMS-2019-129

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-mtzj-rqrc-syas

Risk_score null

Resource_url http://public2.vulnerablecode.io/packages/pkg:npm/jwt-simple@0.5.3

Package Instance