Package · RubyGems

json-jwt

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

High 8.4

CVE-2023-51774

json-jwt allows bypass of identity checks via a sign/encryption confusion attack

The json-jwt (aka JSON::JWT) gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode.

kube-fluentd-operator kube-fluentd-operator-oci-entrypoint kube-fluentd-operator-default-config kube-fluentd-operator-compat Ubuntu Wolfi RubyGems

Dec 25, 2023
High 7.5

CVE-2019-18848

JSON-jwt Gem lacked element count during splitting of JWE string

The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.

json-jwt ruby-json-jwt ruby-json-jwt Debian Ubuntu RubyGems

Nov 12, 2019