p PatchFirst

PatchFirst · Latest vulnerabilities

gree/jose vulnerabilities

Vulnerabilities published for gree/jose in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 2

  1. GHSA-9gxv-x7rp-r2hc

    Not ratedFix available

    gree/jose - "None" Algorithm treated as valid in tokens

    Several widely-used JSON Web Token (JWT) libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys (RS256, RS384, RS512, ES256, ES384, ES512).

    gree/josePHP
    • Update to 2.2.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2016-5431

    High · CVSS 7.5EPSS 0.95%Fix available

    CVE-2016-5431

    The PHP JOSE Library by Gree Inc. before version 2.2.1 is vulnerable to key confusion/algorithm substitution in the JWS component resulting in bypassing the signature verification via crafted tokens.

    gree/josePHP
    • Update to 2.2.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →