CVE-2017-16007CWE-200

CVE-2017-16007: vulnerability in HackerOne node-jose node module

Published 04 Jun 2018 · Updated 16 Sep 2024

Follow this CVE + Monitor node-jose node module + Monitor node-jose

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.9%

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier than version 0.9.3 is vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) is used.

Affected products

HackerOne · node-jose node module

References

http://blog.intothesymmetry.com/2017/03/critical-vulnerability-in-json-web.html https://gist.github.com/asanso/fa25685348051ef6a28d49aa0f27a4ae https://github.com/cisco/node-jose https://nodesecurity.io/advisories/324