CVE Feed

    Dashboard / CVE / CVE-2017-12974

    CVE-2017-12974

    Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows attackers to conduct an Invalid Curve Attack in environments where the JCE provider lacks the applicable curve validation.

    Published:Aug 20, 2017
    Last Modified:Apr 20, 2025
    EPS:Aug 20, 2017
    EPSS Score:0.002
    CVSS Score:7.5

    Affected Products

    Vendor
    Connect2id
    Product
    Nimbus Jose\+jwt

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-463 Padding Oracle Crypto Attack
    CAPEC-475 Signature Spoofing by Improper Validation

    References

    https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f3a7a801f0c6b078899fed9226368eb7b44e2b2f
    https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/217/explicit-check-for-ec-public-key-on-curve
    https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt
    https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
    https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f3a7a801f0c6b078899fed9226368eb7b44e2b2f
    https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/217/explicit-check-for-ec-public-key-on-curve
    https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt
    https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High