CVE-2017-16007 | BDVDB-2026-101644 Detail

HackerOnenode-jose node module

Description#

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 is vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) is used.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References#

https://gist.github.com/asanso/fa25685348051ef6a28d49aa0f27a4ae
https://nodesecurity.io/advisories/324
http://blog.intothesymmetry.com/2017/03/critical-vulnerability-in-json-web.html
https://github.com/cisco/node-jose

Exploit#

No public exploit known

History#

Version 12018-06-04Record published in the CVE List.
Version 22024-09-16Most recent update recorded in the CVE List.