CVE-2019-18848 (json-jwt): json-jwt improper input validation due to lack of element count when splitting string

November 14th, 2019

ADVISORIES

GEM

SEVERITY

CVSS v3.x: 7.5 (High)

PATCHED VERSIONS

>= 1.11.0

DESCRIPTION

The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.