CVE-2023-31582: Weak Cryptographic Algorithm in jose4j

org.bitbucket.b_c:jose4j Updated 02 Oct 2025

Summary

25/10/2023

Disclosed on

CVE-2023-31582

CVE

Yes i

Fix available

High

Severity

7.5

CVSS Score

CVE-2023-31582: jose4j uses weak cryptographic algorithm. Affects org.bitbucket.b_c:jose4j versions < 0.9.3. Fixed in 0.9.3. How to fix ↓

Also tracked for

libjose4j-java · Debian:13

The same CVE-2023-31582 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

jose4j is a Java library that provides support for the JSON Object Signing and Encryption (JOSE) specifications. It allows developers to work with JSON Web Tokens (JWTs) for secure communication and authentication. The library is commonly used in applications that require token-based authentication and encryption. However, a vulnerability has been discovered in jose4j versions prior to 0.9.3.

Vulnerability Detail

The vulnerability in jose4j arises from the use of a weak cryptographic algorithm. Specifically, the library allows attackers to set a low PBES2 iteration count of 1000 or less. This weakens the security of the encryption process and makes it easier for attackers to decrypt sensitive information. The impact of this vulnerability can be significant, as it compromises the confidentiality and integrity of data protected by jose4j.

How To Fix

Minimum fixed version

0.9.3

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There is no known workaround for this vulnerability. It is recommended to update to the fixed version of jose4j as soon as possible.

Conclusion

The vulnerability in jose4j versions prior to 0.9.3 allows attackers to exploit a weak cryptographic algorithm, compromising the security of data protected by the library. To mitigate this vulnerability, it is crucial to update jose4j to version 0.9.3 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.bitbucket.b_c:jose4j →