CVE-2016-7037

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function for hash comparison, which allows attackers to spoof signatures via a timing attack.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-361

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/95847
https://github.com/emarref/jwt/pull/20Issue Tracking, Patch, Third Party Advisory
https://github.com/emarref/jwt/releases/tag/1.0.3Issue Tracking, Patch, Third Party Advisory
http://www.securityfocus.com/bid/95847
https://github.com/emarref/jwt/pull/20Issue Tracking, Patch, Third Party Advisory
https://github.com/emarref/jwt/releases/tag/1.0.3Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Jan 23, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-70387.3In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.CVE-2016-70397.5The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service (stack consumption and panic) or possibl CVE-2016-70408.8Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and t CVE-2016-70416.5Drools Workbench contains a path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory CVE-2016-70426.2The proc_keys_show function in security/keys/proc.c in the Linux kernel through 4.8.2, when the GNU Compiler Collection (gcc) stack protecto CVE-2016-70439.8It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java proper CVE-2016-70447.5The unformat_24bit_color function in the format parsing code in Irssi before 0.8.20, when compiled with true-color enabled, allows remote at CVE-2016-70457.5The format_send_to_gui function in the format parsing code in Irssi before 0.8.20 allows remote attackers to cause a denial of service (heap CVE-2016-70465.9Red Hat JBoss Enterprise Application Platform (EAP) 7, when operating as a reverse-proxy with default buffer sizes, allows remote attackers CVE-2016-70474.3A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqReportResults capability w CVE-2016-70488.1The interactive installer in PostgreSQL before 9.3.15, 9.4.x before 9.4.10, and 9.5.x before 9.5.5 might allow remote attackers to execute a CVE-2016-70509.8SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server