CVE-2018-1000539: Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM e...

Description

Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 1.9.4 and later.

Metrics

EPSS Probability

0.78%

51.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-347

Affected Software

Vendor	Product	Versions
Json-Jwt Project	Json-Jwt	>= 0.5.0, < 1.9.4

References

https://github.com/nov/json-jwt/pull/62Third Party Advisory
https://www.debian.org/security/2018/dsa-4283
https://github.com/nov/json-jwt/pull/62Third Party Advisory
https://www.debian.org/security/2018/dsa-4283

Timeline

Published: Jun 26, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-1000539?

Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 1.9.4 and later.

How severe is CVE-2018-1000539?

Severity scoring for CVE-2018-1000539 is pending analysis. The EPSS model estimates a 0.78% probability of exploitation in the next 30 days.

How do I fix CVE-2018-1000539?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2018

View all 2018CVEs →