CVE-2022-23529 – node-jsonwebtoken

Posted by robin_reala on Tuesday January 10, 2023 @05:27AM
from the nvd.nist.gov dept.

https://nvd.nist.gov/vuln/detail/CVE-2022-23529

( 3 comments | on HN )

Re:CVE-2022-23529 – node-jsonwebtoken by michaelermer on Tuesday January 10, 2023 @12:54PM (#34328694)

This CVE is a joke, there is no attack vector. If an attacker is able to create an object with an executable function in the scope claimed in the CVE, he may just run the malicious code himself.

[ Parent | on HN ]

Re:CVE-2022-23529 – node-jsonwebtoken by zacharyvoase on Tuesday January 10, 2023 @06:17PM (#34332865)

If this is a CVE, then arguably any method invocation on any function argument in any JavaScript library is a CVE, and we might as well throw the whole thing away. Is there a way to challenge this as not-a-CVE?

[ Parent | on HN ]

Re:CVE-2022-23529 – node-jsonwebtoken by michaelermer on Tuesday January 10, 2023 @07:20PM (#34333402)

I am trying this on GitHub https://github.com/github/advisory-database/pull/1595

[ Parent | on HN ]