{"action":"Upgrade com.nimbusds:nimbus-jose-jwt to 4.39 or later.","affected":[{"fixed":"4.39","introduced":"0"}],"component":"com.nimbusds:nimbus-jose-jwt","cve_ids":["CVE-2017-12973"],"ecosystem":"Maven","epss":0.00637,"exploited":false,"fixed_versions":["4.39"],"ghsa_id":"GHSA-jfmq-4g4m-99rh","id":"tcs_01M5N92SST87BK8HN0XD351T7M","modified_at":"2023-11-08T03:58:54.759362Z","published_at":"2022-05-13T01:42:51Z","references":["https://osv.dev/vulnerability/GHSA-jfmq-4g4m-99rh","https://nvd.nist.gov/vuln/detail/CVE-2017-12973","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/6a29f10f723f406eb25555f55842c59a43a38912","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/223/aescbc-return-immediately-on-invalid-hmac","https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt"],"severity":{"label":"low","score":3.1},"sources":[{"source":"osv","source_id":"GHSA-jfmq-4g4m-99rh","url":"https://osv.dev/vulnerability/GHSA-jfmq-4g4m-99rh"}],"summary":"Nimbus JOSE+JWT vulnerable to padding oracle attack"}