Details
-
Type:
Bug
-
Status: Closed
-
Priority:
Major
-
Resolution: Fixed
-
Affects Version/s: None
-
Fix Version/s: 3.1.9
-
Component/s: JAX-RS Security
-
Labels:None
-
Estimated Complexity:Unknown
Description
There's a bug I spotted in the elliptic curve encryption code in JOSE - I'm not sure off hand what the correct behaviour is:
EcdhDirectKeyJweEncryption.EcdhHelper takes a "String ctAlgo" as a parameter that is later used as:
ContentAlgorithm jwtAlgo = ContentAlgorithm.valueOf(ctAlgo);
However, EcdhAesWrapKeyEncryptionAlgorithm which constructs EcdhHelper, passes through the key algorithm, not the content algorithm - keyAlgo.getJwaName() leading to an error.