7.5
CVE-2015-10004
- EPSS 0.75%
- Veröffentlicht 27.12.2022 22:15:10
- Zuletzt bearbeitet 11.04.2025 23:15:25
- Quelle security@golang.org
- CVE-Watchlists
- Unerledigt
LoginTiming side-channel in github.com/robbert229/jwt
Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Json Web Token Project ≫ Json Web Token Version- SwPlatformgo
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.75% | 0.5 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
CWE-668 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
https://github.com/robbert229/jwt/commit/ca1404ee6e83fcbafb66b09ed0d543850a15b654
https://github.com/robbert229/jwt/issues/12
https://pkg.go.dev/vuln/GO-2020-0023