Description
JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class. NOTE: the vendor disputes this because the "ignores" behavior cannot occur (in any version) unless there is a user error in how JJWT is used, and because the version that was actually tested must have been more than six years out of date.
INFO
Published Date :
2024-04-01T00:00:00.000Z
Last Modified :
2024-08-27T17:59:14.397Z
Source :
mitre
AFFECTED PRODUCTS
The following products are affected by CVE-2024-31033 vulnerability.
No data.
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2024-31033.
