Detections
Analytics
SCA: security update for node-jose (GHSA-jfxm-w8g2-4rcv)
high Tenable Self-Hosted Container Security Plugin ID 433862
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated,
remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due
to node-jose following the JSON Web Signature (JWS) standard for JSON Web Tokens (JWTs). This standard
specifies that a JSON Web Key (JWK) representing a public key can be embedded within the header of a JWS.
This public key is then trusted for verification. An attacker could exploit this by forging valid JWS
objects by removing the original signature, adding a new public key to the header, and then signing the
object using the (attacker-owned) private key associated with the public key embedded in that JWS header.
(CVE-2018-0114)
See Also
Plugin Details
Severity: High
ID: 433862
Version: Revision 1.3
Type: Local
Family: SCA Checks
Published: 8/19/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5.7
Percentile: 96.53
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2018-0114
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 5/13/2022
Vulnerability Publication Date: 1/4/2018
Reference Information
CVE: CVE-2018-0114
BID: 102445
cwe: CWE-347