Description
Affected versions of node-jose are vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) is used.
Proof of Concept
Recommendation
Update the node-jose package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.9.3
- Patched version(s): 0.9.3
References
Could your website be exposed too?
SmartScanner can check your website for Invalid Curve Attack in node-jose and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Invalid Curve Attack in openpgp - CVE-2019-9155
- Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime - CVE-2021-29446
- Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtime - CVE-2021-29445
- Cisco node-jose improper validation of JWT signature - CVE-2018-0114
You might also like:
See something that needs correcting? Let us knowUpdated September 06, 2023