IHayden136755 (Community Member) asked a question.
nimbus-jose-jwt:7.8.1, CVE-2019-17195 flaw not being reported
The SCA report for our software contains nimbus-jose-jwt:7.8.1 which does not report any flaw. However the CVE-2019-17195 report says the fix was made in 7.9.0 and that the vulnerable range is 2.9-7.8:
If the fix was made in 7.9 shouldn't 7.8.1 also be vulnerable and flagged accordingly in our scan?
.png){kind=logo}
Hello @IHayden136755 (Community Member) ,
For a fixed version, it sounds like you believe that version 7.8.x is the same as 7.8, which it is not. Version 7.8.1 would have been made after 7.8, meaning it’s not inclusive of the specified range. Hopefully, this clears up any confusion with the safe version range,
Jason
Veracode Support Engineer
Hi Jason, thanks for your reply.
I understand that 7.8.1 was created after 7.8, but it is not clear that this version contains the fix. On one hand your documentation says that the affected range is 2.9-7.8 but in the text it says that the flaw is fixed in 7.9.
Of course the fix may be in both 7.8.1 and 7.9 but it is not clear as the text implies that I'd need to upgrade to 7.9 for the fix, whereas I could just upgrade to 7.8.1?
I will trust that 7.8.1 is safe based on your response, but it would help to change the documentation to clarify things.
Best regards,
Ian
Hi @IHayden136755 (Community Member) ,
After reviewing your response I talked to the engineers and they stated that 7.8.1 is not affected and should be marked as a safe version and the fix. The reason for this is that 7.8.1 was released and synced after version - 7.9, which is the cause for the discrepancy. The Vulnerability Database for CVE-2019-17195 has been updated to reflect that.
Jason
Veracode Support Engineer
Thanks Jason, that's perfect.