{"action":"Upgrade ruby-json-jwt to 1.9.4-1 or later.","affected":[{"fixed":"1.9.4-1","introduced":"0"}],"component":"ruby-json-jwt","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["1.9.4-1"],"id":"tcs_01M5NCV5MFBWEWNB5E4KK5DKMM","modified_at":"2026-10-23T18:02:55.881379303Z","published_at":"2018-06-26T16:29:02.163Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000539","https://security-tracker.debian.org/tracker/CVE-2018-1000539"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2018-1000539#Debian:13/ruby-json-jwt","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000539"}],"summary":"Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attack"}