cbcvebase.
CVE-2017-12974
published 2017-08-20

CVE-2017-12974: Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows…

PriorityP335high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EPSS
1.26%
66.2th percentile
Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows attackers to conduct an Invalid Curve Attack in environments where the JCE provider lacks the applicable curve validation.

Affected

123 ranges· showing 25
VendorProductVersion rangeFixed in
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——
connect2idnimbus_jose_+jwt——

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.