CVE-2024-31033: JJWT improperly generates signing keys

April 1, 2024

JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class.

References

github.com/2308652512/JJWT_BUG
github.com/advisories/GHSA-r65j-6h5f-4f92
github.com/jwtk/jjwt
nvd.nist.gov/vuln/detail/CVE-2024-31033
www.viralpatel.net/java-create-validate-jwt-token

Code Behaviors & Features

Detect and mitigate CVE-2024-31033 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →