CVE-2021-29500: Improper Verification of Cryptographic Signature

June 4, 2021 (updated June 15, 2021)

bubble fireworks is an open source java package relating to Spring Framework. In bubble fireworks BUILD-SNAPSHOT there is a vulnerability in which the package did not properly verify the signature of JSON Web Tokens. This allows to forgery of valid JWTs.

References

nvd.nist.gov/vuln/detail/CVE-2021-29500

Code Behaviors & Features

Detect and mitigate CVE-2021-29500 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →