Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows attackers to conduct an Invalid Curve Attack in environments where the JCE provider lacks the applicable curve validation.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Nimbus JOSE+JWT 安全漏洞
Vulnerability Description
Nimbus JOSE+JWT是一个开源的Java库。该库用于创建、检查、序列化和解析JSON Web签名对象和JSON Web加密对象等。 Nimbus JOSE+JWT 4.36之前的版本中存在安全漏洞。攻击者可利用该漏洞实施Invalid Curve攻击。
CVSS Information
N/A
Vulnerability Type
N/A