GHSA-mhpq-9638-x6pw

Duplicate Advisory: Denial of service when decrypting attack controlled input in github.com/dvsekhvalnov/jose2go

Retiré · 2026-02-03 17:53 UTC

En bref

Publiée: 2023-12-20 20:31 UTC
Mise à jour: 2026-09-10 03:49 UTC
CVE: CVE-2023-50658
Alias: GHSA-6294-6rgp-fr7r, GO-2023-2409
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Description

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6294-6rgp-fr7r. This link is maintained to preserve external references. ## Original Description An attacker controlled input of a PBES2 encrypted JWE blob can have a very large p2c value that, when decrypted, produces a denial-of-service.

Paquets affectés

Paquet	Versions
Go · github.com/dvsekhvalnov/jose2go	introduced 0, fixed 1.5.1-0.20231206184617-48ba0b76bc88

Références

https://github.com/dvsekhvalnov/jose2go/issues/31 WEB
https://github.com/dvsekhvalnov/jose2go/commit/a4584e9dd7128608fedbc67892eba9697f0d5317 WEB
https://github.com/dvsekhvalnov/jose2go PACKAGE
https://www.blackhat.com/us-23/briefings/schedule/#three-new-attacks-against-json-web-tokens-31695 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database