GO-2023-2409
Denial of service when decrypting attacker controlled input in github.com/dvsekhvalnov/jose2go
At a glance
- Published
- Updated
- CVE
- CVE-2023-50658
- Aliases
- GHSA-6294-6rgp-fr7r, GHSA-mhpq-9638-x6pw
Description
An attacker controlled input of a PBES2 encrypted JWE blob can have a very large p2c value that, when decrypted, produces a denial-of-service.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/dvsekhvalnov/jose2go | introduced 0, fixed 1.5.1-0.20231206184617-48ba0b76bc88 |
References
- https://github.com/dvsekhvalnov/jose2go/issues/31 WEB
- https://www.blackhat.com/us-23/briefings/schedule/#three-new-attacks-against-json-web-tokens-31695 WEB
- https://github.com/dvsekhvalnov/jose2go/commit/a4584e9dd7128608fedbc67892eba9697f0d5317 FIX
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |