Approved changes feed: RSS · Atom
cpe:2.3:a:jwtk:jjwt:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Jwtk (23aad48c-1990-5179-bc5a-3ad4c77a14a1) |
|---|---|
| Product | Jjwt (71369921-71ac-53fe-babb-124bfb6d60f2) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-31033 |
vulnerable | 2026-06-08 06:35:30.821599 |
Details available
JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class. NOTE: the vendor disputes this because the "ignores" behavior cannot occur (in any version) unless there is a user error in how JJWT is used, and because the version that was actually tested must have been more than six years out of date.
Published: 2024-04-01T00:00:00.000Z
Updated: 2024-08-27T17:59:14.397Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.