NVD Vulnerability Detail

CVE-2018-0114

Summary	A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature (JWS) standard for JSON Web Tokens (JWTs). This standard specifies that a JSON Web Key (JWK) representing a public key can be embedded within the header of a JWS. This public key is then trusted for verification. An attacker could exploit this by forging valid JWS objects by removing the original signature, adding a new public key to the header, and then signing the object using the (attacker-owned) private key associated with the public key embedded in that JWS header.
Publication Date	Jan. 4, 2018, 3:29 p.m.
Registration Date	March 1, 2021, 6:35 p.m.
Last Update	Nov. 21, 2024, 12:37 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:cisco:node-jose::::::::					0.11.0

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/102445	Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/102445	Third Party Advisory VDB Entry
3	https://github.com/cisco/node-jose/blob/master/CHANGELOG.md	Release Notes Third Party Advisory
4	https://github.com/cisco/node-jose/blob/master/CHANGELOG.md	Release Notes Third Party Advisory
5	https://github.com/zi0Black/POC-CVE-2018-0114	Exploit Third Party Advisory
6	https://github.com/zi0Black/POC-CVE-2018-0114	Exploit Third Party Advisory
7	https://tools.cisco.com/security/center/viewAlert.x?alertId=56326	Patch Vendor Advisory
8	https://tools.cisco.com/security/center/viewAlert.x?alertId=56326	Patch Vendor Advisory
9	https://www.exploit-db.com/exploits/44324/	Third Party Advisory VDB Entry
10	https://www.exploit-db.com/exploits/44324/	Third Party Advisory VDB Entry

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-347	デジタル署名の不適切な検証	https://cwe.mitre.org/data/definitions/347.html

JVN Vulnerability Information

Cisco node-jose オープンソースライブラリにおける鍵管理のエラーに関する脆弱性

Title	Cisco node-jose オープンソースライブラリにおける鍵管理のエラーに関する脆弱性
Summary	Cisco node-jose オープンソースライブラリには、鍵管理のエラーに関する脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 4, 2018, midnight
Registration Date	Feb. 8, 2018, 11:51 a.m.
Last Update	Feb. 8, 2018, 11:51 a.m.

Affected System

シスコシステムズ

node-jose 0.11.0 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-0114	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0114
National Vulnerability Database (NVD)
2	CVE-2018-0114	https://nvd.nist.gov/vuln/detail/CVE-2018-0114

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-320	https://cwe.mitre.org/data/definitions/320.html

ベンダー情報

No	Name	URL
GitHub
1	0.11.0 (2017-11-30)	https://github.com/cisco/node-jose/blob/master/CHANGELOG.md
Multivendor Vulnerability Alert
2	Alert ID: 56326	https://tools.cisco.com/security/center/viewAlert.x?alertId=56326

Change Log

No	Changed Details	Date of change
0	[2018年02月08日] 掲載	Feb. 17, 2018, 10:37 a.m.