CyberRota Analysis
AI-GeneratedThe jose package for OCaml prior to version 0.11.0 contains a critical vulnerability where RSA signature validation improperly confirms validity based solely on successful PKCS #1 decoding, bypassing essential public key verification steps. This flaw could allow attackers to forge signatures, potentially compromising the integrity of applications relying on this library for secure communications. Developers and organizations utilizing the jose package should prioritize immediate updates to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.