You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Path to dependency file: /core/jazz_cognito-admin-authorizer/package.json
Path to vulnerable library: /core/jazz_cognito-admin-authorizer/node_modules/jsonwebtoken/package.json,/core/jazz_cognito-authorizer/node_modules/jsonwebtoken/package.json,/core/jazz_token-authorizer/node_modules/jsonwebtoken/package.json
jsonwebtoken is an implementation of JSON Web Tokens. Versions <= 8.5.1 of jsonwebtoken library can be misconfigured so that passing a poorly implemented key retrieval function referring to the secretOrPublicKey argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.
mend-for-github-combot
changed the title
CVE-2022-23541 (Medium) detected in jsonwebtoken-7.4.3.tgz
CVE-2022-23541 (High) detected in jsonwebtoken-7.4.3.tgz
Jan 3, 2023
mend-for-github-combot
changed the title
CVE-2022-23541 (High) detected in jsonwebtoken-7.4.3.tgz
CVE-2022-23541 (Medium) detected in jsonwebtoken-7.4.3.tgz
Mar 8, 2023
mend-for-github-combot
changed the title
CVE-2022-23541 (Medium) detected in jsonwebtoken-7.4.3.tgz
CVE-2022-23541 (Medium) detected in jsonwebtoken-7.4.3.tgz - autoclosed
May 4, 2024
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
mend-for-github-combot
changed the title
CVE-2022-23541 (Medium) detected in jsonwebtoken-7.4.3.tgz - autoclosed
CVE-2022-23541 (Medium) detected in jsonwebtoken-7.4.3.tgz
May 4, 2024
ℹ️ This issue was automatically closed by Mend because it is a duplicate of an existing issue: #396
mend-for-github-combot
changed the title
CVE-2022-23541 (Medium) detected in jsonwebtoken-7.4.3.tgz
CVE-2022-23541 (Medium) detected in jsonwebtoken-7.4.3.tgz - autoclosed
May 19, 2024
CVE-2022-23541 - Medium Severity Vulnerability
Vulnerable Library - jsonwebtoken-7.4.3.tgz
JSON Web Token implementation (symmetric and asymmetric)
Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-7.4.3.tgz
Path to dependency file: /core/jazz_cognito-admin-authorizer/package.json
Path to vulnerable library: /core/jazz_cognito-admin-authorizer/node_modules/jsonwebtoken/package.json,/core/jazz_cognito-authorizer/node_modules/jsonwebtoken/package.json,/core/jazz_token-authorizer/node_modules/jsonwebtoken/package.json
Dependency Hierarchy:
Found in HEAD commit: 712665b267203375ee4b15e1f8d1ebe08abc1547
Found in base branch: develop
Vulnerability Details
jsonwebtoken is an implementation of JSON Web Tokens. Versions
<= 8.5.1
ofjsonwebtoken
library can be misconfigured so that passing a poorly implemented key retrieval function referring to thesecretOrPublicKey
argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.Publish Date: 2022-12-22
URL: CVE-2022-23541
CVSS 3 Score Details (6.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-hjrf-2m68-5959
Release Date: 2022-12-22
Fix Resolution: 9.0.0
The text was updated successfully, but these errors were encountered: