Skip to content
OpenAdvisories
Medium WID-SEC-2023-0218 4 CVEs

IBM Integration Bus: Mehrere Schwachstellen

Published Jan 29, 2023 · Updated Jan 29, 2023 · de-DE

Vendor: IBM Product: Integration Bus 10.0.0.0 - 10.0.0.26 Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in IBM Integration Bus ausnutzen, um beliebigen Programmcode auszuführen oder Sicherheitsvorkehrungen zu umgehen.

Product

IBM Integration Bus ist ein "lightweight" ESB, welche die Integration von SOAP oder non-SOAP Datenquellen von verschiedenen Plattformen ermöglicht.

Vulnerabilities 4

  • Medium 6.4
    CVE-2022-23540

    jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

    In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify…

    auth0 node-jsonwebtoken jsonwebtoken npm
  • Medium 5.9
    CVE-2022-23539

    jsonwebtoken unrestricted key type could lead to legacy keys usage

    Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key …

    auth0 node-jsonwebtoken jsonwebtoken npm
  • Medium 5.0
    CVE-2022-23541

    jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC

    jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result…

    auth0 node-jsonwebtoken jsonwebtoken npm
  • Unscored —
    CVE-2022-23529 Public exploit Rejected

    DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The issue is not a vulnerability. Notes: none.

Revision history

  1. #1

    Initiale Fassung

References