Vulnerability CVE-2021-46743: Information

Description

In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. NOTE: this provides a straightforward way to use the PHP-JWT library unsafely, but might not be considered a vulnerability in the library itself.

Severity: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity: MEDIUM (5.8)
Vector: CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N
URL: https://nvd.nist.gov/vuln/detail/CVE-2021-46743
Published: March 29, 2022
Modified: Nov. 21, 2024
Error type identifier: CWE-843

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
itopsisyphus3.0.3-alt13.2.2-alt2ALT-PU-2023-1879-3321861Fixed
itopsisyphus_e2k3.0.3-alt13.1.1.1-alt1ALT-PU-2023-3678-1-Fixed
itopp113.0.3-alt13.1.1.1-alt1ALT-PU-2023-1879-3321861Fixed
itopp103.1.1.1-alt13.1.1.1-alt1ALT-PU-2024-4537-3343613Fixed
itopp10_e2k3.1.1.1-alt13.1.1.1-alt1ALT-PU-2024-4805-1-Fixed
itopc10f23.1.1.1-alt13.2.2-alt1ALT-PU-2024-4549-3343622Fixed
itopc9f23.1.1.1-alt13.2.0.2-alt0.c9f2.1ALT-PU-2024-4547-3343621Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://github.com/firebase/php-jwt/issues/351
  • Exploit
  • Third Party Advisory
GHSA-8xf4-w7qw-pjjw
      1. cpe:2.3:a:google:firebase_php-jwt:*:*:*:*:*:*:*:*
        End excluding
        6.0.0
    VKontakte|Telegram|YouTube|Forum|ALT Linux Space|Bugzilla
    Version: v26.2.2
    Back to top