Description

JPaseto before 0.3.0 generates weak hashes when using v2.local tokens.

Remediation

References

https://github.com/paseto-toolkit/jpaseto/releases/tag/jpaseto-0.3.0

Related Vulnerabilities

CVE-2022-24999 Vulnerability in npm package qs

CVE-2023-3442 Vulnerability in maven package io.jenkins.plugins:servicenow-devops

CVE-2021-33611 Vulnerability in maven package org.webjars.bowergithub.vaadin:vaadin-menu-bar

CVE-2019-13506 Vulnerability in npm package @nuxtjs/devalue

CVE-2022-41919 Vulnerability in npm package fastify

Severity

High

Classification

CWE-326 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Third Party Advisory