nodejs-jwt-simple before version 0.3.1 allows users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use case of the JWT, the end result is a complete authentication bypass with minimal effort. External References: https://nodesecurity.io/advisories/87 https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/ Upstream Fix: https://github.com/hokaccha/node-jwt-simple/pull/16 Upstream Issue: https://github.com/hokaccha/node-jwt-simple/issues/14
Created nodejs-jwt-simple tracking bugs for this issue: Affects: epel-all [bug 1584957] Affects: fedora-all [bug 1584956]
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.