CVE-2024-31033: Medium severity IBM Controller vulnerability
Withdrawn Advisory
This advisory has been withdrawn because it has been found to be disputed. Please see the issue here for more information.
Original Description
JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class.
Other sources
JJWT (aka Java JWT) through 0.12.5 ignores certain characters and thus a user might falsely conclude that they have a strong key. The impacted code is the setSigningKey() method within the DefaultJwtParser class and the signWith() method within the DefaultJwtBuilder class. NOTE: the vendor disputes this because the "ignores" behavior cannot occur (in any version) unless there is a user error in how JJWT is used, and because the version that was actually tested must have been more than six years out of date.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-31033?
The severity of CVE-2024-31033 has not been specified as the advisory has been withdrawn.
How do I fix CVE-2024-31033?
No fix is currently available for CVE-2024-31033 since it has been withdrawn due to being disputed.
What software is affected by CVE-2024-31033?
CVE-2024-31033 affects JJWT through version 0.12.5.
Is CVE-2024-31033 still considered a vulnerability?
CVE-2024-31033 is not currently considered a valid vulnerability as the advisory has been withdrawn.
Where can I find more information about CVE-2024-31033?
Information regarding CVE-2024-31033 can be found on its GitHub repository where the issue is discussed.