CVE-2020-15957

2020-07-3014:15:12

Google

osv.dev

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.7%

JSON

An issue was discovered in DP3T-Backend-SDK before 1.1.1 for Decentralised Privacy-Preserving Proximity Tracing (DP3T). When it is configured to check JWT before uploading/publishing keys, it is possible to skip the signature check by providing a JWT token with alg=none.

CPENameOperatorVersion
dp3t-sdk-backendeq1.1.0
dp3t-sdk-backendeq1.0.2
dp3t-sdk-backendeq1.0.1
dp3t-sdk-backendeq1.0.0
dp3t-sdk-backendeqSNAPSHOT
dp3t-sdk-backendeq1.0.3
dp3t-sdk-backendeqtestsession-1
dp3t-sdk-backendeq1.0.4
dp3t-sdk-backendeq1.1.0-RC1
dp3t-sdk-backendeq1.0.5-alpha

Name	Operator	Version
dp3t-sdk-backend	eq	1.1.0
dp3t-sdk-backend	eq	1.0.2
dp3t-sdk-backend	eq	1.0.1
dp3t-sdk-backend	eq	1.0.0
dp3t-sdk-backend	eq	SNAPSHOT
dp3t-sdk-backend	eq	1.0.3
dp3t-sdk-backend	eq	testsession-1
dp3t-sdk-backend	eq	1.0.4
dp3t-sdk-backend	eq	1.1.0-RC1
dp3t-sdk-backend	eq	1.0.5-alpha