Lack of Integer-Overflow Check in Nimbus JOSE+JWT by Connect2id

CVE-2017-12972

What is CVE-2017-12972?

In Nimbus JOSE+JWT prior to version 4.39, there is a critical oversight where integer-overflow checks are omitted when converting length values from bytes to bits. This vulnerability enables attackers to exploit the system by performing HMAC bypass attacks, altering the Additional Authenticated Data (AAD) and ciphertext. As a result, an attacker can manage to produce different plaintext results while using the same HMAC, posing significant security risks to applications relying on this library.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References