CVE-2021-41106: Lcobucci/jwt File Reference Keys Leads To Vulnerability
MODERATECVE-2021-41106 is a MODERATE (CVSS 4.4) file reference keys leads to vulnerability (CWE-345: Insufficient Verification of Data Authenticity) affecting Lcobucci/jwt libraries in the Packagist ecosystem. The issue involves file reference keys leads to incorrect hashes on hmac algorithms. Remediation is available by upgrading affected packages to version 3.4.6, 4.0.4, 4.1.5.
CVE-2021-41106 at a Glance
Security Impact
CVSS: 4.4
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
How to Fix CVE-2021-41106
To remediate this vulnerability, upgrade all affected Lcobucci/jwt dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade lcobucci/jwt to 3.4.6Upgrade lcobucci/jwt to 4.0.4Upgrade lcobucci/jwt to 4.1.5Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for lcobucci/jwtHow to Check if You Are Affected
To determine whether your application is affected by CVE-2021-41106, inspect your project dependencies for Lcobucci/jwt:
inspect dependencies for lcobucci/jwtAnalyze the terminal output to locate any version of Lcobucci/jwt in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.4.6), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-345: Insufficient Verification of Data Authenticity, where the product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. In Lcobucci/jwt, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2021-41106 Affected Lcobucci/jwt Versions
3 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
lcobucci/jwt
|
Packagist |
≥ 3.4.0
< 3.4.6
|
3.4.6
|
|
lcobucci/jwt
|
Packagist |
≥ 4.0.0
< 4.0.4
|
4.0.4
|
|
lcobucci/jwt
|
Packagist |
≥ 4.1.0
< 4.1.5
|
4.1.5
|
References
Frequently Asked Questions
What is CVE-2021-41106?
Which Lcobucci/jwt versions are affected?
What version fixes CVE-2021-41106?
Is lcobucci/jwt affected?
What is the CVSS score of CVE-2021-41106?
What CWE is associated with CVE-2021-41106?
How can I check Packagist dependencies for CVE-2021-41106?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-7322-jrq4-x5hf",
"modified" : "2021-09-29T18:04:31Z",
"published" : "2021-09-29T17:09:40Z",
"aliases" : [ "CVE-2021-41106" ],
"summary" : "File reference keys leads to incorrect hashes on HMAC algorithms",
"details" : "### Impact\n\nUsers of HMAC-based algorithms (HS256, HS384, and HS512) combined with `Lcobucci\\JWT\\Signer\\Key\\LocalFileReference` as key are having their tokens issued/validated using the file path as hashing key - instead of the contents.\n\nThe HMAC hashing functions take any string as input and, since users can issue and validate tokens, people are lead to believe that everything works properly.\n\n### Patches\n\nAll versions have been patched to always load the file contents, deprecated the `Lcobucci\\JWT\\Signer\\Key\\LocalFileReference`, and suggest `Lcobucci\\JWT\\Signer\\Key\\InMemory` as the alternative.\n\n### Workarounds\n\nUse `Lcobucci\\JWT\\Signer\\Key\\InMemory` instead of `Lcobucci\\JWT\\Signer\\Key\\LocalFileReference` to create the instances of your keys:\n\n```diff\n-use Lcobucci\\JWT\\Signer\\Key\\LocalFileReference;\n+use Lcobucci\\JWT\\Signer\\Key\\InMemory;\n\n-$key = LocalFileReference::file(__DIR__ . '/public-key.pem');\n+$key = InMemory::file(__DIR__ . '/public-key.pem');\n```",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "lcobucci/jwt"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "3.4.0"
}, {
"fixed" : "3.4.6"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "lcobucci/jwt"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.0.0"
}, {
"fixed" : "4.0.4"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "lcobucci/jwt"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.1.0"
}, {
"fixed" : "4.1.5"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/lcobucci/jwt/security/advisories/GHSA-7322-jrq4-x5hf"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2021-41106"
}, {
"type" : "WEB",
"url" : "https://github.com/lcobucci/jwt/commit/8175de5b841fbe3fd97d2d49b3fc15c4ecb39a73"
}, {
"type" : "WEB",
"url" : "https://github.com/lcobucci/jwt/commit/c45bb8b961a8e742d8f6b88ef5ff1bd5cca5d01c"
}, {
"type" : "WEB",
"url" : "https://github.com/FriendsOfPHP/security-advisories/blob/master/lcobucci/jwt/CVE-2021-41106.yaml"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/lcobucci/jwt"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-345" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2021-09-28T21:27:18Z",
"nvd_published_at" : "2021-09-28T21:15:00Z"
}
}