We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)
Bugpilot (Bug tracking)

Ok

THREATINT CVE Home CVE Diag Help
PUBLISHED

CVE-2024-31033

Reserved:2024-03-27
Published:2024-04-01
Updated:2024-04-03

Description

JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class. NOTE: the vendor disputes this because the "ignores" behavior cannot occur (in any version) unless there is a user error in how JJWT is used, and because the version that was actually tested must have been more than six years out of date.

References

https://github.com/jwtk/jjwt

https://www.viralpatel.net/java-create-validate-jwt-token/

https://github.com/2308652512/JJWT_BUG

https://github.com/jwtk/jjwt/issues/930#issuecomment-2032699358

cve.org CVE-2024-31033

nvd.nist.gov CVE-2024-31033

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-31033