jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption (JWE) standard. In versions 1.1.0 and below, authentication tags of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs. This puts users at risk because JWEs can be modified to decrypt to an arbitrary value, decrypted by observing parsing differences and the GCM internal GHASH key can be recovered. Users are affected by this vulnerability even if they do not use an AES-GCM encryption algorithm for their JWEs. As the GHASH key may have been leaked, users must rotate the encryption keys after upgrading. This issue is fixed in version 1.1.1.
Authentication tags of encrypted JWE tokens are not properly protected against brute-force attacks (CWE-354 — improper verification of data integrity). An attacker, observing differences in processing (parsing differences), can guess the authentication tag and recover the internal GHASH key used by GCM encryption mode. This results in the ability to modify and decrypt JWE tokens to arbitrary values, and the recovered GHASH key can be exploited for further attacks even when the application does not directly use the AES-GCM algorithm.
An attacker can gain unauthorized access to sensitive data encrypted in JWE tokens, modify tokens to decrypt them to arbitrary values, and recover the internal GHASH key, which may enable the creation of forged JWE tokens.
The jwe library should be updated to version 1.1.1, where the issue has been fixed. Due to possible GHASH key leakage, the vendor requires mandatory encryption key rotation after the update — this applies to all library users, even those not using the AES-GCM algorithm.
jwe library (Ruby) in version 1.1.0 and earlier
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N