Low
Security advisory
Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackers to conduct a padding oracle attack.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-12973
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:13 UTC · Revision 1
Source evidence
Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackers to conduct a padding oracle attack.
osv:CVE-2017-12973
Complete source record
{
"id": "43cf1fee1e5c142a14ce4e1e8dc6d466dfcc3e04a3806f6035235e43744c8118",
"url": "https://osv.dev/vulnerability/CVE-2017-12973",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-12973",
"summary": "Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackers to conduct a padding oracle attack.",
"evidence": "osv:CVE-2017-12973",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2017-12973",
"aliases": [
"CVE-2017-12973",
"GHSA-jfmq-4g4m-99rh"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://bitbucket.org/connect2id/nimbus-jose-jwt",
"type": "GIT",
"events": [
{
"introduced": "f46fe5204828a77b7a7c34977de9284e0da26085"
},
{
"last_affected": "fb7850e081d2f04b889dec3e1d18f5bbc45c7f23"
},
{
"fixed": "6a29f10f723f406eb25555f55842c59a43a38912"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0"
},
{
"last_affected": "2.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.0.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.1"
},
{
"last_affected": "2.0.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.1"
},
{
"last_affected": "2.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.1.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.1.1"
},
{
"last_affected": "2.1.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.2"
},
{
"last_affected": "2.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.3"
},
{
"last_affected": "2.3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.4:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.4"
},
{
"last_affected": "2.4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.5:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.5"
},
{
"last_affected": "2.5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.6:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.6"
},
{
"last_affected": "2.6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.7:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.7"
},
{
"last_affected": "2.7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.8:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.8"
},
{
"last_affected": "2.8"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.9:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.9"
},
{
"last_affected": "2.9"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.10:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.10"
},
{
"last_affected": "2.10"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.10.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.10.1"
},
{
"last_affected": "2.10.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.11.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.11.0"
},
{
"last_affected": "2.11.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.12.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.12.0"
},
{
"last_affected": "2.12.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.13.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.13.0"
},
{
"last_affected": "2.13.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.13.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.13.1"
},
{
"last_affected": "2.13.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.14:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.14"
},
{
"last_affected": "2.14"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.15:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.15"
},
{
"last_affected": "2.15"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.15.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.15.1"
},
{
"last_affected": "2.15.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.15.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.15.2"
},
{
"last_affected": "2.15.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.16:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.16"
},
{
"last_affected": "2.16"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.17:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.17"
},
{
"last_affected": "2.17"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.17.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.17.1"
},
{
"last_affected": "2.17.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.17.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.17.2"
},
{
"last_affected": "2.17.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.18:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.18"
},
{
"last_affected": "2.18"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.18.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.18.1"
},
{
"last_affected": "2.18.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.18.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.18.2"
},
{
"last_affected": "2.18.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.19:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.19"
},
{
"last_affected": "2.19"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.19.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.19.1"
},
{
"last_affected": "2.19.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.20:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.20"
},
{
"last_affected": "2.20"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.21:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.21"
},
{
"last_affected": "2.21"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.22:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.22"
},
{
"last_affected": "2.22"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.22.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.22.1"
},
{
"last_affected": "2.22.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.23:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.23"
},
{
"last_affected": "2.23"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.24:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.24"
},
{
"last_affected": "2.24"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.25:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.25"
},
{
"last_affected": "2.25"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.26:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.26"
},
{
"last_affected": "2.26"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.26.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.26.1"
},
{
"last_affected": "2.26.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0"
},
{
"last_affected": "3.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.1"
},
{
"last_affected": "3.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.1.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.1.1"
},
{
"last_affected": "3.1.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.1.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.1.2"
},
{
"last_affected": "3.1.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.2"
},
{
"last_affected": "3.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.2.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.2.1"
},
{
"last_affected": "3.2.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.2.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.2.2"
},
{
"last_affected": "3.2.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.3"
},
{
"last_affected": "3.3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.4:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.4"
},
{
"last_affected": "3.4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.5:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.5"
},
{
"last_affected": "3.5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.6:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.6"
},
{
"last_affected": "3.6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.7:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.7"
},
{
"last_affected": "3.7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.8:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.8"
},
{
"last_affected": "3.8"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.8.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.8.1"
},
{
"last_affected": "3.8.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.8.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.8.2"
},
{
"last_affected": "3.8.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.9:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.9"
},
{
"last_affected": "3.9"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.9.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.9.1"
},
{
"last_affected": "3.9.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.9.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.9.2"
},
{
"last_affected": "3.9.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.10:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.10"
},
{
"last_affected": "3.10"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0"
},
{
"last_affected": "4.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.0.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.1"
},
{
"last_affected": "4.0.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1"
},
{
"last_affected": "4.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.1.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1.1"
},
{
"last_affected": "4.1.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.2"
},
{
"last_affected": "4.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.3"
},
{
"last_affected": "4.3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.3.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.3.1"
},
{
"last_affected": "4.3.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.4:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.4"
},
{
"last_affected": "4.4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.5:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.5"
},
{
"last_affected": "4.5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.6:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.6"
},
{
"last_affected": "4.6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.7:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.7"
},
{
"last_affected": "4.7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.8:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.8"
},
{
"last_affected": "4.8"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.9:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.9"
},
{
"last_affected": "4.9"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.10:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.10"
},
{
"last_affected": "4.10"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.11:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.11"
},
{
"last_affected": "4.11"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.11.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.11.1"
},
{
"last_affected": "4.11.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.11.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.11.2"
},
{
"last_affected": "4.11.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.12:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.12"
},
{
"last_affected": "4.12"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.13:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.13"
},
{
"last_affected": "4.13"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.13.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.13.1"
},
{
"last_affected": "4.13.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.14:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.14"
},
{
"last_affected": "4.14"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.15:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.15"
},
{
"last_affected": "4.15"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.15.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.15.1"
},
{
"last_affected": "4.15.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.16:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.16"
},
{
"last_affected": "4.16"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.16.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.16.1"
},
{
"last_affected": "4.16.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.16.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.16.2"
},
{
"last_affected": "4.16.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.17:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.17"
},
{
"last_affected": "4.17"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.18:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.18"
},
{
"last_affected": "4.18"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.19:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.19"
},
{
"last_affected": "4.19"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.20:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.20"
},
{
"last_affected": "4.20"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.21:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.21"
},
{
"last_affected": "4.21"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.22:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.22"
},
{
"last_affected": "4.22"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.23:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.23"
},
{
"last_affected": "4.23"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.24:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.24"
},
{
"last_affected": "4.24"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.25:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.25"
},
{
"last_affected": "4.25"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.26:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.26"
},
{
"last_affected": "4.26"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.26.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.26.1"
},
{
"last_affected": "4.26.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.27:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.27"
},
{
"last_affected": "4.27"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.27.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.27.1"
},
{
"last_affected": "4.27.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.28:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.28"
},
{
"last_affected": "4.28"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.29:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.29"
},
{
"last_affected": "4.29"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.30:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.30"
},
{
"last_affected": "4.30"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.31:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.31"
},
{
"last_affected": "4.31"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.31.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.31.1"
},
{
"last_affected": "4.31.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.32:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.32"
},
{
"last_affected": "4.32"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.33:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.33"
},
{
"last_affected": "4.33"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.34:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.34"
},
{
"last_affected": "4.34"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.34.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.34.1"
},
{
"last_affected": "4.34.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.34.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.34.2"
},
{
"last_affected": "4.34.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.35:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.35"
},
{
"last_affected": "4.35"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.36.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.36.1"
},
{
"last_affected": "4.36.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.37:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.37"
},
{
"last_affected": "4.37"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.37.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.37.1"
},
{
"last_affected": "4.37.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.38:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.38"
},
{
"last_affected": "4.38"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "6a29f10f723f406eb25555f55842c59a43a38912"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"2.0",
"2.0.1",
"2.1",
"2.1.1",
"2.10",
"2.10.1",
"2.11.0",
"2.12.0",
"2.13.0",
"2.13.1",
"2.14",
"2.15",
"2.15.1",
"2.15.2",
"2.16",
"2.17",
"2.17.1",
"2.17.2",
"2.18",
"2.18.1",
"2.18.2",
"2.19",
"2.19.1",
"2.2",
"2.20",
"2.21",
"2.22",
"2.22.1",
"2.23",
"2.24",
"2.25",
"2.26",
"2.26.1",
"2.3",
"2.4",
"2.5",
"2.6",
"2.7",
"2.8",
"2.9",
"3.0",
"3.1",
"3.1.1",
"3.1.2",
"3.10",
"3.2",
"3.2.1",
"3.2.2",
"3.3",
"3.4",
"3.5",
"3.6",
"3.7",
"3.8",
"3.8.1",
"3.8.2",
"3.9",
"3.9.1",
"3.9.2",
"4.0",
"4.0.1",
"4.1",
"4.1.1",
"4.10",
"4.11",
"4.11.1",
"4.11.2",
"4.12",
"4.13",
"4.13.1",
"4.14",
"4.15",
"4.15.1",
"4.16",
"4.16.1",
"4.16.2",
"4.17",
"4.18",
"4.19",
"4.2",
"4.20",
"4.21",
"4.22",
"4.23",
"4.24",
"4.25",
"4.26",
"4.26.1",
"4.27",
"4.27.1",
"4.28",
"4.29",
"4.3",
"4.3.1",
"4.30",
"4.31",
"4.32",
"4.33",
"4.34",
"4.34.1",
"4.34.2",
"4.35",
"4.36.1",
"4.37",
"4.37.1",
"4.38",
"4.4",
"4.5",
"4.6",
"4.7",
"4.8",
"4.9",
"4.36",
"4.31.1",
"4.0-rc4",
"4.0-rc3",
"4.0-rc2",
"4.0-rc1",
"2.15.0",
"2.14.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12973.json",
"vanir_signatures": [
{
"id": "CVE-2017-12973-83ba7880",
"digest": {
"threshold": 0.9,
"line_hashes": [
"36435077182769648824144539200763482764",
"221225405666008085863157926433643063529",
"248275944443145673308968769694312607101",
"320447986941090818350865767914465061256",
"257738106142193723590480276808990837124",
"190253527059679348300378316158431539755",
"15674162120766882722956143379512560123"
]
},
"source": "https://bitbucket.org/connect2id/nimbus-jose-jwt@6a29f10f723f406eb25555f55842c59a43a38912",
"target": {
"file": "src/test/java/com/nimbusds/jose/crypto/AESCBCTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-12973-8fddb8aa",
"digest": {
"length": 831,
"function_hash": "30873108536757750440668463301508600213"
},
"source": "https://bitbucket.org/connect2id/nimbus-jose-jwt@6a29f10f723f406eb25555f55842c59a43a38912",
"target": {
"file": "src/main/java/com/nimbusds/jose/crypto/AESCBC.java",
"function": "decryptAuthenticated"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-12973-bc84ece8",
"digest": {
"length": 1109,
"function_hash": "236213427891800737982253186864940241476"
},
"source": "https://bitbucket.org/connect2id/nimbus-jose-jwt@6a29f10f723f406eb25555f55842c59a43a38912",
"target": {
"file": "src/main/java/com/nimbusds/jose/crypto/AESCBC.java",
"function": "decryptWithConcatKDF"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-12973-f4fd57ce",
"digest": {
"threshold": 0.9,
"line_hashes": [
"35018700141178900754895011799387586413",
"23210894372056268032297871442564513847",
"102375337653080225852646387558193098844",
"143802061001915409894760621002970574355",
"186448877813480750470093697857407943500",
"156186524451473883298028680057499734344",
"314799720785399631741077152447637097045",
"332890821269199314396999039272601680450",
"115380475547764836096130112939018077308",
"112515943459359502487605947776116967647",
"172612522757869334105109761993727279884",
"142039361351170592512047791599796892391",
"95946088047134294800092685466486312825",
"60152373669270615370440034498579187985",
"280492070757543771453027851327819029791",
"221403414440494563007614824018889324485",
"1894466923688934958026594011629943405",
"59741151086996169066197142383462513440",
"233078262287712076948859519221598030403",
"30861009376071704210913003331615204446",
"332947917171967944776808918114577282512",
"18136453160694785944270925616851898192",
"40475491843953653643162699661677929363",
"151246875674351598710595633477384636928",
"322974018495388437913836007418169443313",
"76069166384751547997871421196598149788",
"44437097317994459278761123799175645327",
"277190829670493988396513370163311149761",
"94546924572782216804672716981269134975",
"82318690769468239319429518385763591879"
]
},
"source": "https://bitbucket.org/connect2id/nimbus-jose-jwt@6a29f10f723f406eb25555f55842c59a43a38912",
"target": {
"file": "src/main/java/com/nimbusds/jose/crypto/AESCBC.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:22:18Z"
}
}
],
"modified": "2026-10-20T13:22:18.126088885Z",
"provider": "osv",
"references": [
"https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/223/aescbc-return-immediately-on-invalid-hmac",
"https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt",
"https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/6a29f10f723f406eb25555f55842c59a43a38912"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.10:*:*:*:*:*:*:*",
"cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.11:*:*:*:*:*:*:*",
"cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.12:*:*:*:*:*:*:*",
"cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.2:*:*:*:*:*:*:*",
"cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.3:*:*:*:*:*:*:*",
"cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.4:*:*:*:*:*:*:*",
"cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.5:*:*:*:*:*:*:*",
"cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.6:*:*:*:*:*:*:*",
"cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.7:*:*:*:*:*:*:*",
"cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.8:*:*:*:*:*:*:*",
"cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.9.1:*:*:*:*:*:*:*",
"cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.9:*:*:*:*:*:*:*"
],
"vendor_product": "connect2id:nimbus_jose+jwt",
"extracted_events": [
{
"range": [
{
"introduced": "1.0"
},
{
"last_affected": "1.0"
},
{
"introduced": "1.1"
},
{
"last_affected": "1.1"
},
{
"introduced": "1.2"
},
{
"last_affected": "1.2"
},
{
"introduced": "1.3"
},
{
"last_affected": "1.3"
},
{
"introduced": "1.4"
},
{
"last_affected": "1.4"
},
{
"introduced": "1.5"
},
{
"last_affected": "1.5"
},
{
"introduced": "1.6"
},
{
"last_affected": "1.6"
},
{
"introduced": "1.7"
},
{
"last_affected": "1.7"
},
{
"introduced": "1.8"
},
{
"last_affected": "1.8"
},
{
"introduced": "1.9"
},
{
"last_affected": "1.9"
},
{
"introduced": "1.9.1"
},
{
"last_affected": "1.9.1"
},
{
"introduced": "1.10"
},
{
"last_affected": "1.10"
},
{
"introduced": "1.11"
},
{
"last_affected": "1.11"
},
{
"introduced": "1.12"
},
{
"last_affected": "1.12"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2017-12973",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387574,
"published_at": "2017-08-20T16:29:00.283+00:00"
}