High This High severity com.nimbusds:nimbus-jose-jwt Dependency vulnerability was introduced in 5.4, 5.11, and 5.12 of Jira Service Management Data Center and Server.
Note: NVD Analysts have not published a CVSS score for this CVE at this time. NVD Analysts use publicly available information at the time of analysis to associate CVSS vector strings.
Atlassian recommends that Jira Service Management Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
| Affected versions | Fixed versions |
|---|---|
| from 5.12.0 LTS to 5.12.5 LTS | 5.12.6 LTS recommended |
| from 5.11.0 to 5.11.3 | 5.12.6 LTS recommended |
| from 5.10.0 to 5.10.2 | 5.12.6 LTS recommended |
| from 5.9.0 to 5.9.2 | 5.12.6 LTS recommended |
| from 5.8.0 to 5.8.2 | 5.12.6 LTS recommended |
| from 5.7.0 to 5.7.2 | 5.12.6 LTS recommended |
| from 5.6.0 to 5.6.2 | 5.12.6 LTS recommended |
| from 5.5.0 to 5.5.1 | 5.12.6 LTS recommended |
| from 5.4.0 LTS to 5.4.18 LTS | 5.12.6 LTS recommended or 5.4.19 LTS |
| from 5.3.0 to 5.3.1 | 5.12.6 LTS recommended or 5.4.19 LTS |
| from 5.2.0 to 5.2.1 | 5.12.6 LTS recommended or 5.4.19 LTS |
| from 5.1.0 to 5.1.1 | 5.12.6 LTS recommended or 5.4.19 LTS |
| 5.0 | 5.12.6 LTS recommended or 5.4.19 LTS |
| from 4.22 to 4.22.6 | 5.12.6 LTS recommended or 5.4.19 LTS |
| Any earlier versions | 5.12.6 LTS recommended or 5.4.19 LTS |
See the release notes: https://confluence.atlassian.com/servicemanagement/jira-service-management-release-notes-780083086.html You can download the latest version of Jira Service Management Data Center and Server from the download center (https://www.atlassian.com/software/jira/service-management/download-archives).
The National Vulnerability Database provides the following description for this vulnerability: In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.