tocsin

Debian/ruby-jwt: critical 9.1

ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because Ope

Action: Upgrade ruby-jwt to 2.7.1-1+deb13u1 or later.

Affected

introducedfixedlast affected
02.7.1-1+deb13u1-

Fixed versions

2.7.1-1+deb13u1

Sources

published · modified · JSON