USN-9059-1: ruby-jwt vulnerability
It was discovered that ruby-jwt incorrectly verified HMAC signatures when the verification key was empty or missing. A remote attacker could possibly use this issue to forge tokens and bypass authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/ruby-jwtto a version that resolves this vulnerability.Fixed in 1.0.0-3ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/ruby-jwtto a version that resolves this vulnerability.Fixed in 1.5.6-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/ruby-jwtto a version that resolves this vulnerability.Fixed in 2.1.0-2ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/ruby-jwtto a version that resolves this vulnerability.Fixed in 2.2.2-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/ruby-jwtto a version that resolves this vulnerability.Fixed in 2.7.1-1+deb13u1build0.24.04.1 - Upgrade
Upgrade
ubuntu/ruby-jwtto a version that resolves this vulnerability.Fixed in 2.7.1-1+deb13u1build0.26.04.1
Event History
Frequently Asked Questions
What condition must exist for exploitation to be possible?
The application must verify HMAC-signed tokens using an empty or missing verification key. Under that condition, a remote attacker may be able to forge tokens and bypass authentication.
Who is exposed to this issue?
Applications using the Ubuntu ruby-jwt package are exposed if they rely on HMAC signature verification and can reach a code path where the verification key is empty or absent.