{"id":"UBUNTU-CVE-2024-25189","details":"libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.","modified":"2026-05-20T16:16:37.368124843Z","published":"2024-02-08T17:15:00Z","upstream":["CVE-2024-25189"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2024-25189"},{"type":"REPORT","url":"https://github.com/P3ngu1nW/CVE_Request/blob/main/benmcollins%3Alibjwt.md"},{"type":"REPORT","url":"https://github.com/benmcollins/libjwt/commit/f73bac57c5bece16ac24f1a70022aa34355fc1bf"},{"type":"REPORT","url":"https://github.com/benmcollins/libjwt/commit/a5d61ef4f1b383876e0a78534383f38159471fd6"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2024-25189"}],"affected":[{"package":{"name":"libjwt","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/libjwt?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.0+dfsg-1","1.8.0+dfsg-2","1.9.0-1","1.9.0-1build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libjwt0","binary_version":"1.9.0-1build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-25189.json"}},{"package":{"name":"libjwt","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/libjwt?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.2-1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.10.2-1","binary_name":"libjwt-gnutls0"},{"binary_name":"libjwt0","binary_version":"1.10.2-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-25189.json"}},{"package":{"name":"libjwt","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/libjwt?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.2-1","1.10.2-1build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libjwt-gnutls0","binary_version":"1.10.2-1build1"},{"binary_name":"libjwt0","binary_version":"1.10.2-1build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-25189.json"}},{"package":{"name":"libjwt","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/libjwt?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.2-1build1","1.17.0-2","1.17.0-2build1","1.17.0-2build2"],"ecosystem_specific":{"binaries":[{"binary_name":"libjwt-gnutls2","binary_version":"1.17.0-2build2"},{"binary_name":"libjwt2","binary_version":"1.17.0-2build2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-25189.json"}},{"package":{"name":"libjwt","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/libjwt?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17.2-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libjwt-gnutls2","binary_version":"1.17.2-1"},{"binary_name":"libjwt2","binary_version":"1.17.2-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-25189.json"}},{"package":{"name":"libjwt","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/libjwt?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17.2-1","1.17.2-1build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libjwt-gnutls2","binary_version":"1.17.2-1build1"},{"binary_version":"1.17.2-1build1","binary_name":"libjwt2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-25189.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]}