Detections
Analytics

SCA: security update for jsonwebtoken (GHSA-qwph-4952-7xr6)

high Tenable Self-Hosted Container Security Plugin ID 418375

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()`
 function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature
 verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This
 issue has been fixed, please update to version 9.0.0 which removes the default support for the none
 algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you
 don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify
 that in `jwt.verify()` options. (CVE-2022-23540)

See Also

https://github.com/advisories/GHSA-qwph-4952-7xr6

Plugin Details

Severity: High

ID: 418375

Version: Revision 1.10

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.9

Percentile: 52.21

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 8

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:C/A:P

CVSS Score Source: CVE-2022-23540

CVSS v3

Risk Factor: High

Base Score: 7.6

Temporal Score: 6.6

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 12/22/2022

Vulnerability Publication Date: 12/22/2022

Reference Information

CVE: CVE-2022-23540