CVE-2016-7037

2017-01-2321:59:02

Google

osv.dev

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.8%

JSON

The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function for hash comparison, which allows attackers to spoof signatures via a timing attack.

CPENameOperatorVersion
jwteq0.1.0
jwteq1.0.1
jwteq0.1.1
jwteq1.0.2
jwteq1.0.0
jwteq0.0.1

Name	Operator	Version
jwt	eq	0.1.0
jwt	eq	1.0.1
jwt	eq	0.1.1
jwt	eq	1.0.2
jwt	eq	1.0.0
jwt	eq	0.0.1

References

www.securityfocus.com/bid/95847

github.com/emarref/jwt/pull/20

github.com/emarref/jwt/releases/tag/1.0.3