CVE-2023-50967
latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
Опубликовано Обновлено
PatchFirst · Свежие уязвимости
Уязвимости jose
За последние 30 дней в jose опубликовано уязвимостей: 0; в каталоге KEV: 0.
Уязвимостей: 2
JOSE vulnerable to resource exhaustion via specifically crafted JWE
JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named `p2c` PBES2 Count, which determines how many PBKDF2 iterations must be executed in order to derive a CEK wrapping key. The purpose of this parameter is to intentionally slow down the key derivation function in order to make password brute-force and dictionary attacks more expensive. This makes the PBES2 algorithms unsuitable for situations where the JWE is coming from an untrusted s
Опубликовано Обновлено
Проверьте свой сервер
Сопоставьте установленный стек и версии со свежими базами уязвимостей.