CVE-2017-18239: Moderate severity vulnerability that affects com.jason-goodwin:authentikat-jwt_2.12

November 9, 2018 (updated August 31, 2021)

A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt (aka com.jason-goodwin/authentikat-jwt) version 0.4.5 and earlier allows the supplier of a JWT token to guess bit after bit of the signature by repeating validation requests.

References

github.com/advisories/GHSA-3rhm-67j6-42jq
github.com/jasongoodwin/authentikat-jwt/commit/2d2fa0d40ac8f2f7aa7e9b070fa1a25eee082cb0
github.com/jasongoodwin/authentikat-jwt/issues/12
github.com/jasongoodwin/authentikat-jwt/pull/36
nvd.nist.gov/vuln/detail/CVE-2017-18239

Code Behaviors & Features

Detect and mitigate CVE-2017-18239 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →