CVE-2017-12974

Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows…

published August 20, 2017

CVSS
—
EPSS
1%
Percentile
69.1
In the wild
Unconfirmed
What it is

Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows attackers to conduct an Invalid Curve Attack in environments where the JCE provider lacks the applicable curve validation.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01256 · 69.1th percentile
Published
2017-08-20T16:00Z
EPSS history
Timeline
  • 20 AUG 16:00Z
    Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows…
    cvelistv5