CVE-2019-18848

EUVD-2019-0742
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 42%
Affected Products (NVD)
VendorProductVersion
json-jwt_projectjson-jwt
𝑥
< 1.11.0
debiandebian_linux
9.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
ruby-json-jwt
bookworm
1.14.0-2
fixed
bullseye
1.11.0-1
fixed
buster
no-dsa
sid
1.14.0-2
fixed
trixie
1.14.0-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby-json-jwt
bionic
needed
disco
ignored
eoan
ignored
focal
not-affected
groovy
not-affected
hirsute
not-affected
impish
not-affected
jammy
not-affected
kinetic
not-affected
lunar
not-affected
mantic
not-affected
noble
not-affected
trusty
dne
xenial
dne
Common Weakness Enumeration
References
https://github.com/nov/json-jwt/commit/ada16e772906efdd035e3df49cb2ae372f0f948a
https://github.com/nov/json-jwt/compare/v1.10.2...v1.11.0
https://lists.debian.org/debian-lts-announce/2020/10/msg00001.html
https://github.com/nov/json-jwt/commit/ada16e772906efdd035e3df49cb2ae372f0f948a
https://github.com/nov/json-jwt/compare/v1.10.2...v1.11.0
https://lists.debian.org/debian-lts-announce/2020/10/msg00001.html