Description
The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function for hash comparison, which allows attackers to spoof signatures via a timing attack.
Unscored
CVE-2016-7037
EUVD-2016-7921GHSA-jqgc-w3wf-c38r
The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function for hash comparison, w…
Published Jan 23, 2017 · Updated Aug 6, 2024 · Assigned by redhat