CVE-2024-25189
CVSS 3.1 Score 9.8 of 10 (high)
Details
Summary
CVE-2024-25189 is a newly disclosed vulnerability affecting version 1.15.3 of the libjwt library. This issue arises from the library's use of the non-constant time strcmp function for authentication verification. An adversary can exploit this timing side channel vulnerability to bypass authentication and gain unauthorized access to protected resources. The impact of this vulnerability is significant as libjwt is widely used for JSON Web Token (JWT) processing in various applications. To mitigate this risk, it's recommended to upgrade to the latest version of the library that uses constant-time comparison functions instead.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions