CVE-2022-23541

Source
https://nvd.nist.gov/vuln/detail/CVE-2022-23541
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-23541.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-23541
Aliases
Related
Published
2022-12-22T18:15:09Z
Modified
2025-01-08T14:03:56.138235Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
[none]
Details

jsonwebtoken is an implementation of JSON Web Tokens. Versions <= 8.5.1 of jsonwebtoken library can be misconfigured so that passing a poorly implemented key retrieval function referring to the secretOrPublicKey argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.

References

Affected packages

Git / github.com/auth0/node-jsonwebtoken

Affected ranges

Type
GIT
Repo
https://github.com/auth0/node-jsonwebtoken
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
Fixed

Affected versions

v0.*

v0.2.0

v1.*

v1.1.1
v1.1.2

v2.*

v2.0.0

v3.*

v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.2.2

v4.*

v4.0.0
v4.1.0
v4.2.0
v4.2.1
v4.2.2

v5.*

v5.0.0
v5.0.1
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.1.0
v5.3.0
v5.3.1
v5.4.0
v5.5.0
v5.5.1
v5.5.2
v5.5.3
v5.5.4
v5.6.0
v5.6.1
v5.6.2
v5.7.0

v6.*

v6.0.0
v6.0.1
v6.1.0
v6.1.1
v6.1.2
v6.2.0

v7.*

v7.0.0
v7.0.1
v7.1.0
v7.1.1
v7.1.10
v7.1.2
v7.1.3
v7.1.4
v7.1.5
v7.1.6
v7.1.7
v7.1.8
v7.1.9
v7.2.0
v7.2.1
v7.3.0
v7.4.0
v7.4.1
v7.4.2
v7.4.3

v8.*

v8.0.0
v8.0.1
v8.1.0
v8.1.1
v8.2.0
v8.2.1
v8.2.2
v8.3.0
v8.5.0
v8.5.1