It was discovered that ruby-jwt incorrectly verified HMAC signatures when the verification key was empty or missing. A remote attacker could possibly use this issue to forge tokens and bypass authentication.
USN-9059-1: ruby-jwt vulnerability
About this summary. This is a short excerpt from the description that Ubuntu Security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://ubuntu.com/security/notices/USN-9059-1
Source attribution: headline and facts are from Ubuntu Security (ubuntu.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
USN-8895-2: Sudo vulnerability
USN-8895-1 fixed a vulnerability in Sudo. This update provides the corresponding updates for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was…
USN-9063-1: Yodl vulnerability
It was discovered that Yodl incorrectly handled certain input, leading to a buffer over-read. An attacker could possibly use this issue to cause Yodl to crash, resulting…
USN-9062-1: SNMPTT vulnerability
It was discovered that SNMPTT did not properly sanitize trap data passed to commands run through the EXEC, PREEXEC, and unknown_trap_exec options. A remote attacker…
USN-9060-1: kramdown vulnerability
It was discovered that kramdown processed the template option in documents by default. An attacker could possibly use this issue to read arbitrary files or execute…
USN-9058-1: Action Pack Page Caching vulnerability
It was discovered that Action Pack Page Caching incorrectly handled certain request paths when writing cached pages. A remote attacker could possibly use this issue to…
USN-9057-1: rkhunter vulnerability
It was discovered that rkhunter downloaded mirror updates over an insecure channel. A remote attacker could possibly use this issue to execute arbitrary code.