CVE - CVE-2021-32631

CVE-ID
CVE-2021-32631	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Common is a package of common modules that can be accessed by NIMBLE services. Common before commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 did not properly verify the signature of JSON Web Tokens. This allows someone to forge a valid JWT. Being able to forge JWTs may lead to authentication bypasses. Commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 contains a patch for the issue. As a workaround, one may use the parseClaimsJws method to correctly verify the signature of a JWT.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://github.com/nimble-platform/common/security/advisories/GHSA-fjq8-896w-pv28 URL:https://github.com/nimble-platform/common/security/advisories/GHSA-fjq8-896w-pv28 MISC:https://github.com/nimble-platform/common/commit/12197a755bd524559bf4e16475595a2c6fcd34db URL:https://github.com/nimble-platform/common/commit/12197a755bd524559bf4e16475595a2c6fcd34db MISC:https://github.com/nimble-platform/common/commit/3b96cb0293d3443b870351945f41d7d55cb34b53 URL:https://github.com/nimble-platform/common/commit/3b96cb0293d3443b870351945f41d7d55cb34b53 MISC:https://github.com/nimble-platform/common/commit/a59ad46733912a5580530e39cac0e6ebc83cc563 URL:https://github.com/nimble-platform/common/commit/a59ad46733912a5580530e39cac0e6ebc83cc563
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20210512	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20210512)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)