Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 1.9.4 and later.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic     Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can     forge a authentication tag. This attack appear to be exploitable via network connectivity. This     vulnerability appears to have been fixed in 1.9.4 and later. (CVE-2018-1000539)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic
    Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can
    forge a authentication tag. This attack appear to be exploitable via network connectivity. This
    vulnerability appears to have been fixed in 1.9.4 and later. (CVE-2018-1000539)

It was discovered that ruby-json-jwt, a Ruby implementation of JSON web tokens performed insufficient validation of GCM auth tags.

ID	Name	Product	Family	Severity
254655	Linux Distros Unpatched Vulnerability : CVE-2018-1000539	Nessus	Misc.	medium
421930	SCA: security update for json-jwt (GHSA-mj4x-wcxf-hm8x)	Tenable Cloud Security	SCA Checks	medium
421930	SCA: security update for json-jwt (GHSA-mj4x-wcxf-hm8x)	Tenable Self-Hosted Container Security	SCA Checks	medium
112233	Debian DSA-4283-1 : ruby-json-jwt - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2018-1000539

medium

Tenable Plugins

medium

medium

medium

medium