CVE-2017-16007

    Dashboard / Vulnerabilities / CVE-2017-16007

    CVE-2017-16007

    Published: 4 Jun 2018Last Modified: 8 Jul 2026

    Summary:

    Details: node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 is vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) is used.

    References: https://github.com/cisco/node-jose, https://nodesecurity.io/advisories/324, https://gist.github.com/asanso/fa25685348051ef6a28d49aa0f27a4ae, http://blog.intothesymmetry.com/2017/03/critical-vulnerability-in-json-web.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -c327c04d4b39995fedb6fcb9d5da9cfac9a82400

    Affected versions

    0.9.2
    0.9.1
    0.9.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High