Description
jose is an npm library providing a number of cryptographic operations.
Recommendation
Update the jose package to the latest compatible version. Followings are version details:
Affected version(s): **>= 3.0.0, < 3.11.4 >= 2.0.0, < 2.0.5 >= 1.0.0, < 1.28.1** Patched version(s): **3.11.4 2.0.5 1.28.1**
References
Could your website be exposed too?
SmartScanner can check your website for Padding Oracle Attack due to Observable Timing Discrepancy in jose and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime - CVE-2021-29444
- Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime - CVE-2021-29446
- Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtime - CVE-2021-29445
- cookie-signature Timing Attack - CVE-2016-1000236
You might also like:
See something that needs correcting? Let us knowUpdated February 01, 2023