GHSA-cff7-6h4q-q5pj

Suggest an improvement
Source
https://github.com/advisories/GHSA-cff7-6h4q-q5pj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/11/GHSA-cff7-6h4q-q5pj/GHSA-cff7-6h4q-q5pj.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-cff7-6h4q-q5pj
Aliases
Published
2019-11-14T15:25:51Z
Modified
2024-02-16T08:11:06.297947Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
JSON-jwt Gem lacked element count during splitting of JWE string
Details

The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.

Database specific 
{
    "nvd_published_at": "2019-11-12T15:15:00Z",
    "cwe_ids": [
        "CWE-287"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2019-11-14T15:24:51Z"
}
References

Affected packages

RubyGems / json-jwt

Package

Name
json-jwt
Purl
pkg:gem/json-jwt

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.11.0

Affected versions

0.*

0.0.0
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.2.0
0.3.0
0.3.1
0.3.2
0.3.3
0.4.0
0.4.1
0.4.2
0.4.3
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.6.0
0.6.1
0.7.0.alpha
0.7.0.alpha2
0.7.0
0.7.1
0.8.0
0.8.1

1.*

1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.3.0
1.3.1
1.4.0
1.5.0
1.5.1
1.5.2
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1.pre
1.8.1
1.8.2
1.8.3
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
1.10.0
1.10.1
1.10.2