Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2019-17195 EUVD-2019-0699GHSA-f6vf-pq8c-69m4

Improper Check for Unusual or Exceptional Conditions in Connect2id Nimbus JOSE+JWT

Published Oct 15, 2019 · Updated Aug 5, 2024 · Assigned by mitre

Package: com.nimbusds:nimbus-jose-jwt Ecosystem: Maven

Description

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 apache-commons-beanutils +1 1.8.3-15.el7_7 RHSA-2020:1308
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Rhev Manager 4 ovirt-engine-extension-aaa-misc 1.0.4-1.el7ev RHSA-2020:1308
Red Hat Rhev Manager 4 ovirt-fast-forward-upgrade 1.0.0-17.el7ev RHSA-2020:1308
Red Hat Rhev Manager 4 rhvm +20 4.3.9.3-0.1.el7 RHSA-2020:1308
Red Hat Rhev Manager 4 rhvm-dependencies 4.3.2-1.el7ev RHSA-2020:1308

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • somatrasss/weblogic2021 ★ 12 · Feb 4, 2021

    CVE-2021-1994、CVE-2021-2047、CVE-2021-2064、CVE-2021-2108、CVE-2021-2075、CVE-2019-17195、CVE-2020-14756、CVE-2021-2109

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.nimbusds:nimbus-jose-jwt < 7.9 7.9 GHSA-f6vf-pq8c-69m4

Advisories 3

References