[
https://issues.apache.org/jira/browse/ATLAS-5085?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
peravelli updated ATLAS-5085:
-----------------------------
Summary: Atlas - Upgrade nimbus-jose-jwt to 10.0.2+ (was: Atlas - Upgrade
nimbus-jose-jwt to 10.0.2+ due to CVE-2025-53864)
> Atlas - Upgrade nimbus-jose-jwt to 10.0.2+
> ------------------------------------------
>
> Key: ATLAS-5085
> URL: https://issues.apache.org/jira/browse/ATLAS-5085
> Project: Atlas
> Issue Type: Task
> Components: atlas-webui
> Reporter: peravelli
> Assignee: peravelli
> Priority: Major
>
>
> *CVE-2025-53864:*
> Connect2id Nimbus JOSE + JWT before 10.0.2 allows a remote attacker to cause
> a denial of service via a deeply nested JSON object supplied in a JWT claim
> set, because of uncontrolled recursion. NOTE: this is independent of the Gson
> 2.11.0 issue because the Connect2id product could have checked the JSON
> object nesting depth, regardless of what limits (if any) were imposed by Gson.
> Severity: 6.9 (medium)
> [https://nvd.nist.gov/vuln/detail/CVE-2025-53864]
> [https://security.snyk.io/vuln/SNYK-JAVA-COMNIMBUSDS-10691768]
> [https://github.com/advisories/GHSA-xwmg-2g98-w7v9]
> [Scan
> Report|https://cloudera-build-2-us-west-2.vpc.cloudera.com/s3/build/68907177/Security_Scan_Results/Dependencies_and_Libraries/parcel/dependency-check-report.html]
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
