1:54 p.m.
FYI,
https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-to...
Regards.
Pedro Igor
2:43 a.m.
It seems to me that we are not vulnerable to this. We're using
RSATokenVerifier everywhere and only allowed algorithms are the RS256,
RS384, RS512. And for all of them, attacker would need realm private key
to sign the token.
Marek
On 2.4.2015 20:54, Pedro Igor Silva wrote:
FYI,
https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-to...
Regards.
Pedro Igor
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
1:55 a.m.
Interesting attack, especially using the public key as hmac secret. Definitively worth
considering if/when we add support for more algs ;)
----- Original Message -----
From: "Pedro Igor Silva" <psilva(a)redhat.com>
To: "keycloak dev" <keycloak-dev(a)lists.jboss.org>
Sent: Thursday, 2 April, 2015 8:54:17 PM
Subject: [keycloak-dev] Critical vulnerabilities in JSON Web Token libraries
FYI,
https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-to...
Regards.
Pedro Igor
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev
3571
days inactive
3576
days old
2 comments
3 participants
participants (3)
-
Marek Posolda -
Pedro Igor Silva -
Stian Thorgersen