{"id":"CVE-2017-12974","details":"Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows attackers to conduct an Invalid Curve Attack in environments where the JCE provider lacks the applicable curve validation.","aliases":["GHSA-pfv2-37f7-9m6w"],"modified":"2026-07-08T12:06:19.022380Z","published":"2017-08-20T16:29:00.313Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.0:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.10:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.11:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.12:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.2:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.3:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.4:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.5:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.6:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.7:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.8:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.9.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:1.9:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.0"},{"last_affected":"1.0"},{"introduced":"1.1"},{"last_affected":"1.1"},{"introduced":"1.2"},{"last_affected":"1.2"},{"introduced":"1.3"},{"last_affected":"1.3"},{"introduced":"1.4"},{"last_affected":"1.4"},{"introduced":"1.5"},{"last_affected":"1.5"},{"introduced":"1.6"},{"last_affected":"1.6"},{"introduced":"1.7"},{"last_affected":"1.7"},{"introduced":"1.8"},{"last_affected":"1.8"},{"introduced":"1.9"},{"last_affected":"1.9"},{"introduced":"1.9.1"},{"last_affected":"1.9.1"},{"introduced":"1.10"},{"last_affected":"1.10"},{"introduced":"1.11"},{"last_affected":"1.11"},{"introduced":"1.12"},{"last_affected":"1.12"}],"source":"CPE_STRING","vendor_product":"connect2id:nimbus_jose+jwt"}]},"references":[{"type":"WEB","url":"https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E"},{"type":"ADVISORY","url":"https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f3a7a801f0c6b078899fed9226368eb7b44e2b2f"},{"type":"ADVISORY","url":"https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt"},{"type":"FIX","url":"https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/217/explicit-check-for-ec-public-key-on-curve"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://bitbucket.org/connect2id/nimbus-jose-jwt","events":[{"introduced":"f46fe5204828a77b7a7c34977de9284e0da26085"},{"last_affected":"a33e4cda470bdd8d33d7074d4ed5ab721297e514"},{"fixed":"f3a7a801f0c6b078899fed9226368eb7b44e2b2f"}],"database_specific":{"cpe":["cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.0:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.0.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.2:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.3:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.4:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.5:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.6:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.7:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.8:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.9:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.10:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.10.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.11.0:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.12.0:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.13.0:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.13.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.14:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.15:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.15.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.15.2:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.16:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.17:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.17.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.17.2:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.18:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.18.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.18.2:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.19:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.19.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.20:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.21:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.22:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.22.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.23:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.24:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.25:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.26:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:2.26.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.0:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.1.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.1.2:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.2:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.2.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.2.2:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.3:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.4:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.5:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.6:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.7:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.8:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.8.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.8.2:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.9:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.9.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.9.2:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:3.10:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.0:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.0.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.1.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.2:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.3:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.3.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.4:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.5:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.6:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.7:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.8:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.9:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.10:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.11:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.11.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.11.2:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.12:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.13:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.13.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.14:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.15:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.15.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.16:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.16.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.16.2:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.17:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.18:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.19:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.20:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.21:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.22:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.23:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.24:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.25:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.26:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.26.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.27:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.27.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.28:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.29:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.30:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.31:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.31.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.32:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.33:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.34:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.34.1:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.34.2:*:*:*:*:*:*:*","cpe:2.3:a:connect2id:nimbus_jose\\+jwt:4.35:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.0"},{"last_affected":"2.0"},{"introduced":"2.0.1"},{"last_affected":"2.0.1"},{"introduced":"2.1"},{"last_affected":"2.1"},{"introduced":"2.1.1"},{"last_affected":"2.1.1"},{"introduced":"2.2"},{"last_affected":"2.2"},{"introduced":"2.3"},{"last_affected":"2.3"},{"introduced":"2.4"},{"last_affected":"2.4"},{"introduced":"2.5"},{"last_affected":"2.5"},{"introduced":"2.6"},{"last_affected":"2.6"},{"introduced":"2.7"},{"last_affected":"2.7"},{"introduced":"2.8"},{"last_affected":"2.8"},{"introduced":"2.9"},{"last_affected":"2.9"},{"introduced":"2.10"},{"last_affected":"2.10"},{"introduced":"2.10.1"},{"last_affected":"2.10.1"},{"introduced":"2.11.0"},{"last_affected":"2.11.0"},{"introduced":"2.12.0"},{"last_affected":"2.12.0"},{"introduced":"2.13.0"},{"last_affected":"2.13.0"},{"introduced":"2.13.1"},{"last_affected":"2.13.1"},{"introduced":"2.14"},{"last_affected":"2.14"},{"introduced":"2.15"},{"last_affected":"2.15"},{"introduced":"2.15.1"},{"last_affected":"2.15.1"},{"introduced":"2.15.2"},{"last_affected":"2.15.2"},{"introduced":"2.16"},{"last_affected":"2.16"},{"introduced":"2.17"},{"last_affected":"2.17"},{"introduced":"2.17.1"},{"last_affected":"2.17.1"},{"introduced":"2.17.2"},{"last_affected":"2.17.2"},{"introduced":"2.18"},{"last_affected":"2.18"},{"introduced":"2.18.1"},{"last_affected":"2.18.1"},{"introduced":"2.18.2"},{"last_affected":"2.18.2"},{"introduced":"2.19"},{"last_affected":"2.19"},{"introduced":"2.19.1"},{"last_affected":"2.19.1"},{"introduced":"2.20"},{"last_affected":"2.20"},{"introduced":"2.21"},{"last_affected":"2.21"},{"introduced":"2.22"},{"last_affected":"2.22"},{"introduced":"2.22.1"},{"last_affected":"2.22.1"},{"introduced":"2.23"},{"last_affected":"2.23"},{"introduced":"2.24"},{"last_affected":"2.24"},{"introduced":"2.25"},{"last_affected":"2.25"},{"introduced":"2.26"},{"last_affected":"2.26"},{"introduced":"2.26.1"},{"last_affected":"2.26.1"},{"introduced":"3.0"},{"last_affected":"3.0"},{"introduced":"3.1"},{"last_affected":"3.1"},{"introduced":"3.1.1"},{"last_affected":"3.1.1"},{"introduced":"3.1.2"},{"last_affected":"3.1.2"},{"introduced":"3.2"},{"last_affected":"3.2"},{"introduced":"3.2.1"},{"last_affected":"3.2.1"},{"introduced":"3.2.2"},{"last_affected":"3.2.2"},{"introduced":"3.3"},{"last_affected":"3.3"},{"introduced":"3.4"},{"last_affected":"3.4"},{"introduced":"3.5"},{"last_affected":"3.5"},{"introduced":"3.6"},{"last_affected":"3.6"},{"introduced":"3.7"},{"last_affected":"3.7"},{"introduced":"3.8"},{"last_affected":"3.8"},{"introduced":"3.8.1"},{"last_affected":"3.8.1"},{"introduced":"3.8.2"},{"last_affected":"3.8.2"},{"introduced":"3.9"},{"last_affected":"3.9"},{"introduced":"3.9.1"},{"last_affected":"3.9.1"},{"introduced":"3.9.2"},{"last_affected":"3.9.2"},{"introduced":"3.10"},{"last_affected":"3.10"},{"introduced":"4.0"},{"last_affected":"4.0"},{"introduced":"4.0.1"},{"last_affected":"4.0.1"},{"introduced":"4.1"},{"last_affected":"4.1"},{"introduced":"4.1.1"},{"last_affected":"4.1.1"},{"introduced":"4.2"},{"last_affected":"4.2"},{"introduced":"4.3"},{"last_affected":"4.3"},{"introduced":"4.3.1"},{"last_affected":"4.3.1"},{"introduced":"4.4"},{"last_affected":"4.4"},{"introduced":"4.5"},{"last_affected":"4.5"},{"introduced":"4.6"},{"last_affected":"4.6"},{"introduced":"4.7"},{"last_affected":"4.7"},{"introduced":"4.8"},{"last_affected":"4.8"},{"introduced":"4.9"},{"last_affected":"4.9"},{"introduced":"4.10"},{"last_affected":"4.10"},{"introduced":"4.11"},{"last_affected":"4.11"},{"introduced":"4.11.1"},{"last_affected":"4.11.1"},{"introduced":"4.11.2"},{"last_affected":"4.11.2"},{"introduced":"4.12"},{"last_affected":"4.12"},{"introduced":"4.13"},{"last_affected":"4.13"},{"introduced":"4.13.1"},{"last_affected":"4.13.1"},{"introduced":"4.14"},{"last_affected":"4.14"},{"introduced":"4.15"},{"last_affected":"4.15"},{"introduced":"4.15.1"},{"last_affected":"4.15.1"},{"introduced":"4.16"},{"last_affected":"4.16"},{"introduced":"4.16.1"},{"last_affected":"4.16.1"},{"introduced":"4.16.2"},{"last_affected":"4.16.2"},{"introduced":"4.17"},{"last_affected":"4.17"},{"introduced":"4.18"},{"last_affected":"4.18"},{"introduced":"4.19"},{"last_affected":"4.19"},{"introduced":"4.20"},{"last_affected":"4.20"},{"introduced":"4.21"},{"last_affected":"4.21"},{"introduced":"4.22"},{"last_affected":"4.22"},{"introduced":"4.23"},{"last_affected":"4.23"},{"introduced":"4.24"},{"last_affected":"4.24"},{"introduced":"4.25"},{"last_affected":"4.25"},{"introduced":"4.26"},{"last_affected":"4.26"},{"introduced":"4.26.1"},{"last_affected":"4.26.1"},{"introduced":"4.27"},{"last_affected":"4.27"},{"introduced":"4.27.1"},{"last_affected":"4.27.1"},{"introduced":"4.28"},{"last_affected":"4.28"},{"introduced":"4.29"},{"last_affected":"4.29"},{"introduced":"4.30"},{"last_affected":"4.30"},{"introduced":"4.31"},{"last_affected":"4.31"},{"introduced":"4.31.1"},{"last_affected":"4.31.1"},{"introduced":"4.32"},{"last_affected":"4.32"},{"introduced":"4.33"},{"last_affected":"4.33"},{"introduced":"4.34"},{"last_affected":"4.34"},{"introduced":"4.34.1"},{"last_affected":"4.34.1"},{"introduced":"4.34.2"},{"last_affected":"4.34.2"},{"introduced":"4.35"},{"last_affected":"4.35"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["2.0","2.0.1","2.1","2.1.1","2.10","2.10.1","2.11.0","2.12.0","2.13.0","2.13.1","2.14","2.15","2.15.1","2.15.2","2.16","2.17","2.17.1","2.17.2","2.18","2.18.1","2.18.2","2.19","2.19.1","2.2","2.20","2.21","2.22","2.22.1","2.23","2.24","2.25","2.26","2.26.1","2.3","2.4","2.5","2.6","2.7","2.8","2.9","3.0","3.1","3.1.1","3.1.2","3.10","3.2","3.2.1","3.2.2","3.3","3.4","3.5","3.6","3.7","3.8","3.8.1","3.8.2","3.9","3.9.1","3.9.2","4.0","4.0.1","4.1","4.1.1","4.10","4.11","4.11.1","4.11.2","4.12","4.13","4.13.1","4.14","4.15","4.15.1","4.16","4.16.1","4.16.2","4.17","4.18","4.19","4.2","4.20","4.21","4.22","4.23","4.24","4.25","4.26","4.26.1","4.27","4.27.1","4.28","4.29","4.3","4.3.1","4.30","4.31","4.32","4.33","4.34","4.34.1","4.34.2","4.35","4.4","4.5","4.6","4.7","4.8","4.9","4.31.1","4.0-rc4","4.0-rc3","4.0-rc2","4.0-rc1","2.15.0","2.14.0"],"database_specific":{"vanir_signatures":[{"digest":{"function_hash":"115793690767974993532499632333152278944","length":671},"id":"CVE-2017-12974-06cffeab","signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/test/java/com/nimbusds/jose/jwk/JWKSelectorTest.java","function":"testSelectByType"},"deprecated":false},{"id":"CVE-2017-12974-10b1df7b","signature_type":"Line","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/test/java/com/nimbusds/jose/crypto/ECDHCurveCheckTest.java"},"deprecated":false,"digest":{"line_hashes":["229033163810581049948023483369748943088","184810028656973937972819577202667284220","7512365147843643622418832741835614770","29415984146548180239177105462670625119","286478071725120290414288469042195859767","89524929776891500953005350555671620476","117952485225437169452367052350587603461","160675419600933412661530555847059023573","251566963156799758862896317245654453867","303120187846805120997121930987777731539","213790623379908782620932483065810605155","303096671598394148046053559261853218776","134209288214006617291076751376111280416","279271354711875875601021976299830231908","202940518131335225481857982087875679372","33040504344766041689033577054894031923","313473533383608514253717961660745822836","13388593287742895801558602216495511544","155880237757756279645115845679535143823","328173123464982408364036421465327989962","261630824063036651850506475324529387091","44041943400274818682113363200932837951","138471193686227187486603349818073127508","236475310997885222842659763591849181688","202940518131335225481857982087875679372","33040504344766041689033577054894031923","77240024161142251863712636174752296635"],"threshold":0.9}},{"signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/test/java/com/nimbusds/jose/jwk/JWKSelectorTest.java","function":"testSelectByOperations"},"deprecated":false,"digest":{"length":802,"function_hash":"310766472562867152041953769956701404768"},"id":"CVE-2017-12974-1d7a02bf","signature_type":"Function"},{"source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/test/java/com/nimbusds/jose/jwk/JWKSelectorTest.java","function":"testSelectByUseNotSpecifiedOrSignature"},"deprecated":false,"digest":{"function_hash":"316834418309585725035623331866074165038","length":1088},"id":"CVE-2017-12974-1dea6cbf","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"39819581511140259334774674935637145781","length":488},"id":"CVE-2017-12974-1fb8fa80","signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/test/java/com/nimbusds/jose/jwk/JWKMatcherTest.java","function":"testMatchUse"}},{"signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/test/java/com/nimbusds/jose/jwk/JWKSelectorTest.java","function":"testSelectByUse"},"deprecated":false,"digest":{"function_hash":"80299183602505714389503476768515496130","length":768},"id":"CVE-2017-12974-298721ad"},{"signature_type":"Line","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/main/java/com/nimbusds/jose/crypto/ECDSAProvider.java"},"deprecated":false,"digest":{"line_hashes":["336036691436671179418466161738295172632","334984794101635182103586540737322434582","102328019666831305873820810509336764539","323787505474747969768355004640676669630","333492772899353608444442265356378243122"],"threshold":0.9},"id":"CVE-2017-12974-386fd2d0"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["210017274296965049404766324474662918220","140815182611687145045540083963238859371","155009990409946109034927015249531197177","185381090406225613840647573481083543898","79076593572591334516623112436057838119","329243045530228031294194377141879384590","87413797786034593891889474541142600871","25084911076119722288554305035063715553","1218991709302224165196208149191109230","166760783499664604567307519266567061143","127381395548264809955877293786257722387","1728939621862126834361292416359232375"]},"id":"CVE-2017-12974-3e8b7b12","signature_type":"Line","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/main/java/com/nimbusds/jose/crypto/ECDSA.java"}},{"signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/main/java/com/nimbusds/jose/crypto/ECDH.java"},"deprecated":false,"digest":{"line_hashes":["182815377190243329887646649609660205522","60137506247049659933856958238820759125","85386169047429620568816236737213820966","225344524061399962740335564326779495178","50257723399363725982204657196006984467","326136220135154069164118267768929929682","249615587161052584412368778370926489679","278138223120892290861333118951570317961","336129588180616646523352287168897110193","102502969722988655142712248054550495670","61003760646427207666780924840367407121","40265423315642826127884135002029600311","70675100956149837444672388821199763222","129357462783325124789639847902003965040","93146001381316604543112895469676956325","313770390308441877653381339077898441140","68870751462179740653838238371952363892","59617636694350782317011166452734995950","34649299591566313571321513150040771857","85080067506818574465277929050349989448","174880145832005209588835527234797191259","89506416580146817412709548231080797421","225582068478022614278240018217641249198","228370437240238372175394782486504354247","32883045570066118420911749498745269543","142862033316416216278529826955721867572","187828759786099870882055583880471603035","198746920740281977070430661092449268775","56284874079283461417974393631383213074","47129091725657627239698917006612136659","133713571874108079225404570555237373454","19775352205793000865893805901370740725","103668125481855709428972447781980238060","60576950524916557773176979031605167662","263742673312935145477300870053069358751","324995861397296068362080582873861430888","6962615884479793154882637407072514186","229355986761826869824614351244127460279","228456316711980161594388981537735234303","286704496331294632209960988223048428095","133733374508710096781164790778250813223","278695574013478602938448052285397517084","50415013489233673234172986705152566503","89257837339952752639098249434800117107","278445540301262564418637782735359410055","182664612553969290526651538883027857723","32204780577058014699527994205283083662","65664703808805684091039010474607193870","102631393016346993426530723456083783646","319871991103727077759106007932029740986","227124893089583677149951977554788527076","220002606182930403707604312859319463290","216946613381185791912400322625335835352","321254278852084863053471093185957346873"],"threshold":0.9},"id":"CVE-2017-12974-3fa94a3b","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/test/java/com/nimbusds/jose/jwk/JWKMatcherTest.java","function":"testMatchType"},"deprecated":false,"digest":{"function_hash":"191782565284279465842835689061820137493","length":447},"id":"CVE-2017-12974-421b1a91"},{"digest":{"line_hashes":["236470030900772878755065766760453312400","57128025929102714987822133225391046874","98212679877720400606831412926554368103","329874248710371006212105089776247611721","95634861452848111315894233239589699951","270871781285801820291509085874991407340","262842568298161134006527210497979987610","144175098575916853532534976922149195719","6986487584361104719680748093065119391","189682384832018974614147529996104315755","53825307741570515013338215644674799497","91989763821850410043046402448721751859","70166094124498327236897203678039791320","10491156228877640422394383951698471509","331669781681102781487548365499717202667","136277594123290229350682999031204941033","257062201404168025737290377429802483763","31650169289149331024982870878543655351","29957411130872284140112477685316648232","151952005647975285329070058499073497777","260961055841832264955825909477705927671","118994232200912534661114324529354764670","321812559452313264362042369630853056553"],"threshold":0.9},"id":"CVE-2017-12974-46dd277b","signature_type":"Line","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/test/java/com/nimbusds/jose/crypto/ECDHCryptoTest.java"},"deprecated":false},{"target":{"file":"src/main/java/com/nimbusds/jose/crypto/ECDHDecrypter.java"},"deprecated":false,"digest":{"line_hashes":["196386182448818158296341723036815672851","2173353030336631711455937346161606869","334328688808465406129721800854495650838","289604219427364935019562720285462736274","302803850110158289992636957996398095525","61718937945002139580157169506950633611","312662002193027935604175216847104391381","337052295799179722601988714166317422239","3592361630180406771362762957125138796","240017845189805789261499706487418129813","310662749570364155189863358866422849177"],"threshold":0.9},"id":"CVE-2017-12974-4717d2dd","signature_type":"Line","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f"},{"target":{"file":"src/test/java/com/nimbusds/jose/crypto/ECDHCurveCheckTest.java","function":"testCycle_ECDH_ES_Curve_P256_attackPoint1"},"deprecated":false,"digest":{"function_hash":"329354059398856326821312839607961251792","length":1108},"id":"CVE-2017-12974-48e4fbd4","signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f"},{"source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/main/java/com/nimbusds/jose/jwk/ECKey.java","function":"ECKey"},"deprecated":false,"digest":{"function_hash":"295471872940219301391394532845872911653","length":734},"id":"CVE-2017-12974-4f95545c","signature_type":"Function","signature_version":"v1"},{"target":{"function":"testSelectByOperationsNotSpecifiedOrSign","file":"src/test/java/com/nimbusds/jose/jwk/JWKSelectorTest.java"},"deprecated":false,"digest":{"function_hash":"110739860310781755897152304984125492406","length":1132},"id":"CVE-2017-12974-5037599f","signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f"},{"signature_type":"Line","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/test/java/com/nimbusds/jose/jwk/JWKSetTest.java"},"deprecated":false,"digest":{"line_hashes":["235515146513400007649680410962057475148","53345822998167239767566800389409698849","146099810415664648681478939220170106858","292191762432850794003870816917817929077","40030472565026346869861060143857778295","319836296614713094601745968698960395036","289224310318737478183960480527101655563","70853064492397653257615064136369137880","316519755646532995952891143453737275054","226336190453818489701042492052204980742","296098576815965099950896469393504175992","6690337665153093354382488517405790787","88415025182974478134658347199627447041","17511274491159218176157028709332250232","101745186780779320669705775358980191669","113325810225594065412237688859054291521","259828761686119737181618347091370411490","192210917725459565661821558680717259972","252531452752639475511204415257942478592","119631193774368311548359248368004214011","214309366663700690528696206573206945475","58762748934461938544585738985355365761","214304565542497740785052644056312739070","15146688568960935754877484102906980507","287092001953640387391404135168557504541","204681954487022899290817931761826886262","149404332954635513162210878422719869620","108988129802387268251454113110741159882","85591789475001149282795568785237830718","332512576472252503779318490361478743347","177260628018115404466558389029862749525","148238014655707654210874493395849828393","270772555727427634506208231396564726804"],"threshold":0.9},"id":"CVE-2017-12974-51e91073"},{"digest":{"function_hash":"87677083404946735186709931575499499376","length":169},"id":"CVE-2017-12974-52ea48ec","signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"function":"testCurveCheckOk","file":"src/test/java/com/nimbusds/jose/crypto/ECDHTest.java"},"deprecated":false},{"target":{"file":"src/test/java/com/nimbusds/jose/jwk/JWKMatcherTest.java","function":"testMatchTwoTypes"},"deprecated":false,"digest":{"function_hash":"284553198026435687565637955443165245395","length":468},"id":"CVE-2017-12974-5881a538","signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f"},{"digest":{"line_hashes":["322487356585512967818111432848408913597","200231269821261856353716466444440809281","178924438207542979338569757549766553620","12964772145809573870176675923796679274","285333595289729981252374754423012041285","266919850519504424399162160443866910661","224879668214815532108368862263572274333","302106254672465255007880024630140140772","309209481946513383253887747801280093316","144936966480920964987702284871348508926","224879668214815532108368862263572274333","302106254672465255007880024630140140772","309209481946513383253887747801280093316","282658214455569149862065094166819708640","305752109598103535425309954118326801232","1851245375481092699948303066751306289","309209481946513383253887747801280093316","102792628663439058701827922123132187014","78179012490310391313070532982139916739","221229413776235507901019814383782487088","44901795775245331080016028967119829366","225287711344347455068794083509535514816","275764691722735082547001304548677305564","321968051161921722561132219371985759316","111448035416401693101651389862431680356","309209481946513383253887747801280093316","196550427440750012977547173154231817111","21762699299580366866522989561292748443","78137316812566066522290708041931516773","188627956458730599900348219123392687573","174309034474592430915830306603786781378"],"threshold":0.9},"id":"CVE-2017-12974-5d7cc018","signature_type":"Line","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/test/java/com/nimbusds/jose/jwk/JWKSelectorTest.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["85910352111965349867195746715427425838","209776897913021641098027112686059181235","229033163810581049948023483369748943088","182395410547847796316232358962882678761","12138186271165021477104811877847827421","37415075669167761660432664572150612975","44443413160706535992439649497155785450","41806323902784997739214730160582298192","38543081996943846420928184156691452196","254108390371183899687445164896154422943","148471294772970882208201421050390562683","335351678247653476676724615258064773420","96074593449945282742221356012242503108","223000993693630701720974002500582681198","234904088378156364610887604349792692799","18764376965725965327390322412103382420","249002300149373181596812186984237640754","16675771894437961018589114118352329981","36639372858239230759243587849529374565","180799408081104976630168319847014017962","234307750337202774070215278485690778865","103911173375294815136142106746424355435","317667874740363222953667974182303276910","138162528298405175305083243345806122073","44669526912559922457397204365492952495","16675771894437961018589114118352329981","36639372858239230759243587849529374565","285500983664423701963763774731202524322","256136638673390603053544099082750731336","2058121724260113676549992669730169014","256641920767350910850880207146954434461","192258957173246662537136757111739654316","255242189698528649324528894278719847224","260823723967806918406779715387213460080","311724389173380482374065008676343470274","302430916599255622134228239120693019907","106653196141120223310840261290960860165","217725693805637077945281677620899809762","184645572182801507160711066109316550971","152300677753231138904258760122629596224","143802602552934742649199654966296108803","177520733562293459929715861003767362199","227820271918614295708015448603717183879","156556962192410818433803877741337314401","111199036358113139570521076733754999269","338605905835881249108210656252692684704","202940518131335225481857982087875679372","33040504344766041689033577054894031923","99781825736337193905695570990081184946","212991228282199474279740538692660597174","197838063620052357757165015839919504345","326931426174623661939640999623637968372","303438131443746826198596945691236813578","300934995305472972066999696635033198340","177520733562293459929715861003767362199","227820271918614295708015448603717183879","156556962192410818433803877741337314401","111199036358113139570521076733754999269","338605905835881249108210656252692684704","202940518131335225481857982087875679372","33040504344766041689033577054894031923","77240024161142251863712636174752296635"],"threshold":0.9},"id":"CVE-2017-12974-620c305a","signature_type":"Line","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/test/java/com/nimbusds/jose/crypto/ECDHTest.java"}},{"id":"CVE-2017-12974-62535a4b","signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/main/java/com/nimbusds/jose/crypto/ECDSA.java","function":"transcodeSignatureToConcat"},"deprecated":false,"digest":{"function_hash":"62941540326894922936032063397801343268","length":1190}},{"deprecated":false,"digest":{"function_hash":"31542781416692075501568268944072777429","length":800},"id":"CVE-2017-12974-64430454","signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/test/java/com/nimbusds/jose/jwk/JWKMatcherTest.java","function":"testMatchOperationsNotSpecifiedOrSign"}},{"signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/test/java/com/nimbusds/jose/jwk/JWKMatcherTest.java","function":"testMatchOperations"},"deprecated":false,"digest":{"function_hash":"94328313012901958487678902478860539573","length":641},"id":"CVE-2017-12974-72a90e22"},{"source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/main/java/com/nimbusds/jose/crypto/ECDHDecrypter.java","function":"decrypt"},"deprecated":false,"digest":{"function_hash":"334730741397467727092743818545472779926","length":1159},"id":"CVE-2017-12974-75c6c6ea","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/test/java/com/nimbusds/jose/jwk/JWKMatcherTest.java","function":"testMatchUseNotSpecifiedOrSignature"},"deprecated":false,"digest":{"length":696,"function_hash":"120189834785918604255963391654252004407"},"id":"CVE-2017-12974-77917f78"},{"deprecated":false,"digest":{"function_hash":"87456369001899711309740812930894818066","length":820},"id":"CVE-2017-12974-77e0114d","signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/test/java/com/nimbusds/jose/jwk/JWKSelectorTest.java","function":"testSelectByTwoTypes"}},{"digest":{"function_hash":"253932938751252844939652417735447454229","length":549},"id":"CVE-2017-12974-843ed1b3","signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/test/java/com/nimbusds/jose/jwk/JWKMatcherTest.java","function":"testMatchOperation"},"deprecated":false},{"source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/test/java/com/nimbusds/jose/crypto/ECDHCryptoTest.java","function":"testRejectECJWKWithUnsupportedCurve"},"deprecated":false,"digest":{"function_hash":"329292172583168979950224752209272285404","length":412},"id":"CVE-2017-12974-84c05fef","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/test/java/com/nimbusds/jose/crypto/ECDHTest.java","function":"testCurveCheckNegative_P256_attackPt2"},"deprecated":false,"digest":{"function_hash":"259132361812610263116092846986830352072","length":813},"id":"CVE-2017-12974-86220087","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"158488332159554619925063940876117682465","length":833},"id":"CVE-2017-12974-9196cc1c","signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"function":"ECKey","file":"src/main/java/com/nimbusds/jose/jwk/ECKey.java"}},{"deprecated":false,"digest":{"line_hashes":["261379831583886945835600780426813573957","37434932984460065201786772612992153612","193141585877421959278191336761392264440","174743459500463007095748036827645426474","58188632493180776627385050107846203878","119465815622241974130632912757850051433","250881387540906230310666319881544772787","263401802760400800839150053331005965802","309594111437081964041720401374168391509","242517978878915210674713076826638468678","222172869467548923857600812531363310160","319346314561852907485400597300479482757","314344422568967708195983845380101958995","87025894006265568872610305191875508854","157113076802215338099467292183601658020","80000134060638282325807704997042355846","223513780841344699597080398744453815198","257170602971602676785567846831971238348","258500344285287099672011924726651979444","202740138952721149463940175524112708851","65603669173384804865298272676265266452","199064905905898891767873433895906573219","52815227029317068155233612303654612764","306331919002592603865026709914121599775","143944632356426272836066103966270496037","271998496862452415054771018696966448557","49610095917592514808803872040501566610","130912553487105490602350476123271524054","19400677357977742147042200713992706656","204628612923605236751660946811977275728","157861198435420721897906882319890764635","218860547983427124526760316874046319551","102190928225342533452262947567873806390","95032944151159771726632821312369143838","152953059322756296906901240283735407969","310008948247087669992486453742350370021"],"threshold":0.9},"id":"CVE-2017-12974-ad1fa6a0","signature_type":"Line","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/test/java/com/nimbusds/jose/jwk/JWKMatcherTest.java"}},{"deprecated":false,"digest":{"function_hash":"277626271912754294526047686496409522955","length":1803},"id":"CVE-2017-12974-b3879f54","signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/test/java/com/nimbusds/jose/jwk/JWKSetTest.java","function":"testSerializeAndParsePublicJWKSet"}},{"deprecated":false,"digest":{"line_hashes":["277090678289041774323282632570496578317","215883825497618763537097648745578295500","50842160152808952489079353400141989332","37200562137240519276110883532872954390","211244111361515287582905113858712766526","300936471949255113832467691347464760695","275822381714715183508268610563999501943","261904390809064544522693743852249151154","56307057177307209043810625244253344347","90919176827930736907384336894725095200","206677318606360355965166163112728165583","326647845042036626235120815575201148268","312005399360265333915770060723599059356","319034707441830285021419734287040754659"],"threshold":0.9},"id":"CVE-2017-12974-b43b90ab","signature_type":"Line","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/main/java/com/nimbusds/jose/crypto/ECDSAVerifier.java"}},{"signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/main/java/com/nimbusds/jose/jwk/ECKey.java","function":"ECKey"},"deprecated":false,"digest":{"length":720,"function_hash":"217183147127849595736944104276209663048"},"id":"CVE-2017-12974-cc379d09","signature_type":"Function"},{"target":{"file":"src/test/java/com/nimbusds/jose/jwk/ECKeyTest.java","function":"testKeySizeForUnknownCurve"},"deprecated":false,"digest":{"function_hash":"41206845297071831307867774494953666416","length":305},"id":"CVE-2017-12974-d4e7e796","signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f"},{"source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/main/java/com/nimbusds/jose/crypto/ECDH.java","function":"ensurePointOnCurve"},"deprecated":false,"digest":{"function_hash":"46782075734428881703441104300275035658","length":667},"id":"CVE-2017-12974-e1b5fa50","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/main/java/com/nimbusds/jose/jwk/ECKey.java"},"deprecated":false,"digest":{"line_hashes":["312992084863168325366415273798073892454","219615243475660326156206818242760671668","14030170966729053957645235369324400088","226461256709299283184051135965655963838","182906553192988473914477468514218369819","160796480478014179467839559760563725159","300966867280254831908470047653840438134","126370258626238652498780304095230480248","208571237428128476487505755513924856553","106398396568683461699320323318477546192","303251714226830929533810311231383133682","177273540095426755078248898523461530504","152363484389884206077990634410480623028","182801564720084258117993067034061895400","224690857591533011730760652953038465586","235062969650810688635781015684632658740","23289604176273381278377042879117802070","116360554387120771486036437646706217245"],"threshold":0.9},"id":"CVE-2017-12974-e8fe1743"},{"target":{"file":"src/main/java/com/nimbusds/jose/crypto/ECDSAVerifier.java","function":"ECDSAVerifier"},"deprecated":false,"digest":{"function_hash":"175459891505232443619645116258139478927","length":171},"id":"CVE-2017-12974-e918edcc","signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f"},{"target":{"file":"src/test/java/com/nimbusds/jose/crypto/ECDHCurveCheckTest.java","function":"testCycle_ECDH_ES_Curve_P256_attackPoint2"},"deprecated":false,"digest":{"function_hash":"126679237480995412222282025145546372602","length":1190},"id":"CVE-2017-12974-ef3a9305","signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f"},{"digest":{"line_hashes":["157104819893341179863527268405595458882","329323524262522372170756918231440757712","147865297071534134676695585076743875355","107884810588539029764855072812873443451","248330082774088762039591562833060548038","320191876016555006018401230638725240523","11851027482832545136095639478556758792","184985624406232459665803765836915705591","269911097687867967074476814569140580951","20959840355128408445363967630592619172","176444075825383913511246134110029948823","136715681104311744305599688350484399058","283261889066025249981031236526534340535","309148017309328482338156616626993433452","314346350093767264836825640383055083254","189167625785902937312131166312753691482","307435256408815529587096290273958399440","109628363482566892407684711708585356783"],"threshold":0.9},"id":"CVE-2017-12974-fc8cf86b","signature_type":"Line","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"file":"src/test/java/com/nimbusds/jose/jwk/ECKeyTest.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"199896025862226092606071155478496136441","length":813},"id":"CVE-2017-12974-fd1a1bed","signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/connect2id/nimbus-jose-jwt@f3a7a801f0c6b078899fed9226368eb7b44e2b2f","target":{"function":"testCurveCheckNegative_P256_attackPt1","file":"src/test/java/com/nimbusds/jose/crypto/ECDHTest.java"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12974.json","vanir_signatures_modified":"2026-07-08T12:06:19Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}