CVE-2016-5429

Published: Sep 3, 2016Modified: May 6, 2026

3.7

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.2 / Impact: 1.4

Source: NVD

Description

jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via a timing attack, related to JWE.php and JWS.php.

Affected (1)

Products: Jose Php Project: Jose Php

Jose Php Project

1 product

Jose Php

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jose Php Project Jose Php	Up to 2.2.0

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (6)

http://www.securityfocus.com/bid/92743

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://github.com/nov/jose-php/commit/1cce55e27adf0274193eb1cd74b927a398a3df4b#diff-2a982d82ef0f673fd0ba2beba0e18420R138

Source: secalert@redhat.com

Patch

https://github.com/nov/jose-php/commit/f03b986b4439e20b0fd635109b48afe96cf0099b#diff-37b0d289d6375ba4a7740401950ccdd6R287

Source: secalert@redhat.com

Patch

http://www.securityfocus.com/bid/92743

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://github.com/nov/jose-php/commit/1cce55e27adf0274193eb1cd74b927a398a3df4b#diff-2a982d82ef0f673fd0ba2beba0e18420R138

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/nov/jose-php/commit/f03b986b4439e20b0fd635109b48afe96cf0099b#diff-37b0d289d6375ba4a7740401950ccdd6R287

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

Timeline

No history available yet.