reason-jose vulnerabilities

1 known vulnerability in reason-jose from Ulrikstrid. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  reason-jose: Improper Verification of Cryptographic Signature

  CVE-2023-23928Feb 1, 2023Ulrikstrid

  reason-jose is a JOSE implementation in ReasonML and OCaml.`Jose.Jws.validate` does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks. Such tampering could expose applications usi