CVE-2019-17195

CWE-755 — Improper Exception HandlingCWE-248CWE-75414 documents7 sources
Severity
9.8CRITICAL
EPSS
3.0%
top 13.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
15
Connect2id Nimbus Jose\+jwtOracle Insurance Policy AdministrationOracle JD Edwards Enterpriseone Orchestrator+12 more
Timeline
PublishedOct 15
Latest updateOct 15

Description

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages16 packages

▶NVDoracle/policy_automation12.2.0 — 12.2.22
▶NVDoracle/primavera_gateway18.8.0 — 18.8.11+1

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

3
OSV
Improper Check for Unusual or Exceptional Conditions in Connect2id Nimbus JOSE+JWT↗2019-10-16
▶
GHSA
Improper Check for Unusual or Exceptional Conditions in Connect2id Nimbus JOSE+JWT↗2019-10-16
▶
CVEList
CVE-2019-17195: Connect2id Nimbus JOSE+JWT before v7↗2019-10-15
▶

📋Vendor Advisories

8
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: WLS Configuration Template (Nimbus JOSE+JWT) — CVE-2019-17195↗2022-10-15
▶
Oracle
Oracle Oracle Systems Risk Matrix: Tools (Nimbus JOSE+JWT) — CVE-2019-17195↗2022-04-15
▶
Oracle
Oracle Oracle Health Sciences Applications Risk Matrix: Install Utility (Nimbus JOSE+JWT) — CVE-2019-17195↗2021-10-15
▶
Oracle
Oracle Oracle Communications Applications Risk Matrix: CNE (Nimbus JOSE+JWT) — CVE-2019-17195↗2021-07-15
▶
Oracle
Oracle Oracle Enterprise Manager Risk Matrix: Enterprise Manager Install (Nimbus JOSE+JWT) — CVE-2019-17195↗2021-04-15
▶

💬Community

2
Bugzilla
CVE-2019-17195 nimbus-jose-jwt: Uncaught exceptions while parsing a JWT↗2019-10-23
▶
Bugzilla
CVE-2019-17195 nimbus-jose-jwt: Uncaught exceptions while parsing a JWT [fedora-all]↗2019-10-23
▶