{"action":"Upgrade com.nimbusds:nimbus-jose-jwt to 4.36 or later.","affected":[{"fixed":"4.36","introduced":"0"}],"component":"com.nimbusds:nimbus-jose-jwt","cve_ids":["CVE-2017-12974"],"ecosystem":"Maven","epss":0.01256,"exploited":false,"fixed_versions":["4.36"],"ghsa_id":"GHSA-pfv2-37f7-9m6w","id":"tcs_01M5N97B3JQ78XTGHW3ZQQ48Z9","modified_at":"2023-11-08T03:58:54.822926Z","published_at":"2022-05-13T01:30:32Z","references":["https://osv.dev/vulnerability/GHSA-pfv2-37f7-9m6w","https://nvd.nist.gov/vuln/detail/CVE-2017-12974","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f3a7a801f0c6b078899fed9226368eb7b44e2b2f","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/217/explicit-check-for-ec-public-key-on-curve","https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt","https://github.com/felx/nimbus-jose-jwt","https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-pfv2-37f7-9m6w","url":"https://osv.dev/vulnerability/GHSA-pfv2-37f7-9m6w"}],"summary":"Improper Verification of Cryptographic Signature in Nimbus JOSE+JWT"}