fkie_cve-2025-45765
Vulnerability from fkie_nvd
Published
2025-08-07 21:15
Modified
2025-08-12 15:15
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Summary
ruby-jwt v3.0.0.beta1 was discovered to contain weak encryption. NOTE: the Supplier's perspective is "keysize is not something that is enforced by this library. Currently more recent versions of OpenSSL are enforcing some key sizes and those restrictions apply to the users of this gem also."
References
cve@mitre.orghttps://gist.github.com/ZupeiNie/c621253068ce5b64911629534879e8f9
cve@mitre.orghttps://github.com/jwt/ruby-jwt/issues/668
Impacted products
Vendor Product Version


To clipboard 

{
  "cveTags": [
    {
      "sourceIdentifier": "cve@mitre.org",
      "tags": [
        "disputed"
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ruby-jwt v3.0.0.beta1 was discovered to contain weak encryption. NOTE: the Supplier\u0027s perspective is \"keysize is not something that is enforced by this library. Currently more recent versions of OpenSSL are enforcing some key sizes and those restrictions apply to the users of this gem also.\""
    },
    {
      "lang": "es",
      "value": "Se descubri\u00f3 que ruby-jwt v3.0.0.beta1 conten\u00eda un cifrado d\u00e9bil. NOTA: El proveedor considera que el tama\u00f1o de clave no es algo que esta librer\u00eda imponga. Actualmente, las versiones m\u00e1s recientes de OpenSSL imponen ciertos tama\u00f1os de clave, y estas restricciones tambi\u00e9n se aplican a los usuarios de esta gema."
    }
  ],
  "id": "CVE-2025-45765",
  "lastModified": "2025-08-12T15:15:29.880",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-08-07T21:15:27.570",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "https://gist.github.com/ZupeiNie/c621253068ce5b64911629534879e8f9"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/jwt/ruby-jwt/issues/668"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-326"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.