GHSA-gvpg-vgmx-xg6w

ghsaUSosv

Denial of Service in Connect2id Nimbus JOSE+JWT

view advisory published 2024-02-11Licence: CC-BY-4.0

In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-52428US	high7.5	0.81% (57th)	—	2024-02-11
In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the Passwor…

references

External citations — patches, advisories, analysis.

https://bitbucket.org/connect2id/nimbus-jose-jwtPACKAGE
https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77eWEB
https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526WEB
https://connect2id.com/products/nimbus-jose-jwtWEB
https://nvd.nist.gov/vuln/detail/CVE-2023-52428ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan