CVE-2017-12972

Published: Aug 20, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers to conduct HMAC bypass attacks by shifting Additional Authenticated Data (AAD) and ciphertext so that different plaintext is obtained for the same HMAC.

Affected (127)

Products: Connect2id: Nimbus Jose+jwt

Connect2id

1 product

Nimbus Jose+jwt

Configuration A

127 vulnerable

Vulnerable Software	Affected Versions
Connect2id Nimbus Jose+jwt	Version 1.0
Connect2id Nimbus Jose+jwt	Version 1.10
Connect2id Nimbus Jose+jwt	Version 1.11
Connect2id Nimbus Jose+jwt	Version 1.12
Connect2id Nimbus Jose+jwt	Version 1.1
Connect2id Nimbus Jose+jwt	Version 1.2
Connect2id Nimbus Jose+jwt	Version 1.3
Connect2id Nimbus Jose+jwt	Version 1.4
Connect2id Nimbus Jose+jwt	Version 1.5
Connect2id Nimbus Jose+jwt	Version 1.6
Connect2id Nimbus Jose+jwt	Version 1.7
Connect2id Nimbus Jose+jwt	Version 1.8
Connect2id Nimbus Jose+jwt	Version 1.9.1
Connect2id Nimbus Jose+jwt	Version 1.9
Connect2id Nimbus Jose+jwt	Version 2.0.1
Connect2id Nimbus Jose+jwt	Version 2.0
Connect2id Nimbus Jose+jwt	Version 2.1.1
Connect2id Nimbus Jose+jwt	Version 2.10.1
Connect2id Nimbus Jose+jwt	Version 2.10
Connect2id Nimbus Jose+jwt	Version 2.11.0
Connect2id Nimbus Jose+jwt	Version 2.12.0
Connect2id Nimbus Jose+jwt	Version 2.13.0
Connect2id Nimbus Jose+jwt	Version 2.13.1
Connect2id Nimbus Jose+jwt	Version 2.14
Connect2id Nimbus Jose+jwt	Version 2.15.1
Connect2id Nimbus Jose+jwt	Version 2.15.2
Connect2id Nimbus Jose+jwt	Version 2.15
Connect2id Nimbus Jose+jwt	Version 2.16
Connect2id Nimbus Jose+jwt	Version 2.17.1
Connect2id Nimbus Jose+jwt	Version 2.17.2
Connect2id Nimbus Jose+jwt	Version 2.17
Connect2id Nimbus Jose+jwt	Version 2.18.1
Connect2id Nimbus Jose+jwt	Version 2.18.2
Connect2id Nimbus Jose+jwt	Version 2.18
Connect2id Nimbus Jose+jwt	Version 2.19.1
Connect2id Nimbus Jose+jwt	Version 2.19
Connect2id Nimbus Jose+jwt	Version 2.1
Connect2id Nimbus Jose+jwt	Version 2.20
Connect2id Nimbus Jose+jwt	Version 2.21
Connect2id Nimbus Jose+jwt	Version 2.22.1
Connect2id Nimbus Jose+jwt	Version 2.22
Connect2id Nimbus Jose+jwt	Version 2.23
Connect2id Nimbus Jose+jwt	Version 2.24
Connect2id Nimbus Jose+jwt	Version 2.25
Connect2id Nimbus Jose+jwt	Version 2.26.1
Connect2id Nimbus Jose+jwt	Version 2.26
Connect2id Nimbus Jose+jwt	Version 2.2
Connect2id Nimbus Jose+jwt	Version 2.3
Connect2id Nimbus Jose+jwt	Version 2.4
Connect2id Nimbus Jose+jwt	Version 2.5
Connect2id Nimbus Jose+jwt	Version 2.6
Connect2id Nimbus Jose+jwt	Version 2.7
Connect2id Nimbus Jose+jwt	Version 2.8
Connect2id Nimbus Jose+jwt	Version 2.9
Connect2id Nimbus Jose+jwt	Version 3.0
Connect2id Nimbus Jose+jwt	Version 3.1.1
Connect2id Nimbus Jose+jwt	Version 3.1.2
Connect2id Nimbus Jose+jwt	Version 3.10
Connect2id Nimbus Jose+jwt	Version 3.1
Connect2id Nimbus Jose+jwt	Version 3.2.1
Connect2id Nimbus Jose+jwt	Version 3.2.2
Connect2id Nimbus Jose+jwt	Version 3.2
Connect2id Nimbus Jose+jwt	Version 3.3
Connect2id Nimbus Jose+jwt	Version 3.4
Connect2id Nimbus Jose+jwt	Version 3.5
Connect2id Nimbus Jose+jwt	Version 3.6
Connect2id Nimbus Jose+jwt	Version 3.7
Connect2id Nimbus Jose+jwt	Version 3.8.1
Connect2id Nimbus Jose+jwt	Version 3.8.2
Connect2id Nimbus Jose+jwt	Version 3.8
Connect2id Nimbus Jose+jwt	Version 3.9.1
Connect2id Nimbus Jose+jwt	Version 3.9.2
Connect2id Nimbus Jose+jwt	Version 3.9
Connect2id Nimbus Jose+jwt	Version 4.0.1
Connect2id Nimbus Jose+jwt	Version 4.0
Connect2id Nimbus Jose+jwt	Version 4.1.1
Connect2id Nimbus Jose+jwt	Version 4.10
Connect2id Nimbus Jose+jwt	Version 4.11.1
Connect2id Nimbus Jose+jwt	Version 4.11.2
Connect2id Nimbus Jose+jwt	Version 4.11
Connect2id Nimbus Jose+jwt	Version 4.12
Connect2id Nimbus Jose+jwt	Version 4.13.1
Connect2id Nimbus Jose+jwt	Version 4.13
Connect2id Nimbus Jose+jwt	Version 4.14
Connect2id Nimbus Jose+jwt	Version 4.15.1
Connect2id Nimbus Jose+jwt	Version 4.15
Connect2id Nimbus Jose+jwt	Version 4.16.1
Connect2id Nimbus Jose+jwt	Version 4.16.2
Connect2id Nimbus Jose+jwt	Version 4.16
Connect2id Nimbus Jose+jwt	Version 4.17
Connect2id Nimbus Jose+jwt	Version 4.18
Connect2id Nimbus Jose+jwt	Version 4.19
Connect2id Nimbus Jose+jwt	Version 4.1
Connect2id Nimbus Jose+jwt	Version 4.20
Connect2id Nimbus Jose+jwt	Version 4.21
Connect2id Nimbus Jose+jwt	Version 4.22
Connect2id Nimbus Jose+jwt	Version 4.23
Connect2id Nimbus Jose+jwt	Version 4.24
Connect2id Nimbus Jose+jwt	Version 4.25
Connect2id Nimbus Jose+jwt	Version 4.26.1
Connect2id Nimbus Jose+jwt	Version 4.26
Connect2id Nimbus Jose+jwt	Version 4.27.1
Connect2id Nimbus Jose+jwt	Version 4.27
Connect2id Nimbus Jose+jwt	Version 4.28
Connect2id Nimbus Jose+jwt	Version 4.29
Connect2id Nimbus Jose+jwt	Version 4.2
Connect2id Nimbus Jose+jwt	Version 4.3.1
Connect2id Nimbus Jose+jwt	Version 4.30
Connect2id Nimbus Jose+jwt	Version 4.31.1
Connect2id Nimbus Jose+jwt	Version 4.31
Connect2id Nimbus Jose+jwt	Version 4.32
Connect2id Nimbus Jose+jwt	Version 4.33
Connect2id Nimbus Jose+jwt	Version 4.34.1
Connect2id Nimbus Jose+jwt	Version 4.34.2
Connect2id Nimbus Jose+jwt	Version 4.34
Connect2id Nimbus Jose+jwt	Version 4.35
Connect2id Nimbus Jose+jwt	Version 4.36.1
Connect2id Nimbus Jose+jwt	Version 4.37.1
Connect2id Nimbus Jose+jwt	Version 4.37
Connect2id Nimbus Jose+jwt	Version 4.38
Connect2id Nimbus Jose+jwt	Version 4.3
Connect2id Nimbus Jose+jwt	Version 4.4
Connect2id Nimbus Jose+jwt	Version 4.5
Connect2id Nimbus Jose+jwt	Version 4.6
Connect2id Nimbus Jose+jwt	Version 4.7
Connect2id Nimbus Jose+jwt	Version 4.8
Connect2id Nimbus Jose+jwt	Version 4.9