Skip to content
OpenAdvisories

Vendor

ulrikstrid

1 known vulnerabilities.

Products

reason-jose 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.9
    CVE-2023-23928

    reason-jose ignores signature checks

    reason-jose is a JOSE implementation in ReasonML and OCaml.`Jose.Jws.validate` does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks. Such tampering could expose applications us…

    ulrikstrid reason-jose