Lack of Integer-Overflow Check in Nimbus JOSE+JWT by Connect2id

CVE-2017-12972

What is CVE-2017-12972?

In Nimbus JOSE+JWT prior to version 4.39, there is a critical oversight where integer-overflow checks are omitted when converting length values from bytes to bits. This vulnerability enables attackers to exploit the system by performing HMAC bypass attacks, altering the Additional Authenticated Data (AAD) and ciphertext. As a result, an attacker can manage to produce different plaintext results while using the same HMAC, posing significant security risks to applications relying on this library.

References