UBUNTU-CVE-2024-25189: Critical severity ubuntu/libjwt vulnerability
Published Feb 8, 2024
·Updated
libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.
Affected Software
4 affected componentsFixes available
ubuntu/libjwt<1.9.0-1ubuntu0.1~esm1
1.9.0-1ubuntu0.1~esm1
ubuntu/libjwt<1.10.2-1ubuntu0.20.04.1~esm1
1.10.2-1ubuntu0.20.04.1~esm1
ubuntu/libjwt<1.10.2-1ubuntu0.22.04.1~esm1
1.10.2-1ubuntu0.22.04.1~esm1
ubuntu/libjwt*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libjwtto a version that resolves this vulnerability.Fixed in 1.9.0-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/libjwtto a version that resolves this vulnerability.Fixed in 1.10.2-1ubuntu0.20.04.1~esm1 - Upgrade
Upgrade
ubuntu/libjwtto a version that resolves this vulnerability.Fixed in 1.10.2-1ubuntu0.22.04.1~esm1
Event History
Feb 8, 2024
CVE Published
via OSV·05:15 PM
Data Sourced
via OSV·05:15 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What level of attacker access is indicated by the severity vector?
The vector indicates network-based exploitation with low attack complexity. It requires no privileges and no user interaction.
2
What is the assessed potential impact if exploitation succeeds?
The severity vector rates confidentiality, integrity, and availability impact as high, with an overall critical score of 9.8.