CVE-2024-29371: jose4j Denial-of-Service Vulnerability via Compressed JWE Content
Summary
CVE-2024-29371: jose4j is vulnerable to DoS via compressed JWE content. Affects org.bitbucket.b_c:jose4j versions < 0.9.5. Fixed in 0.9.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jose4j is an open-source library designed for creating and processing JSON Web Tokens (JWT), JSON Web Encryption (JWE), and JSON Web Signature (JWS). It provides a robust framework for secure data transmission in web applications. However, prior to version 0.9.5, jose4j is susceptible to a Denial-of-Service (DoS) attack due to its handling of compressed JWE tokens, which can lead to excessive resource consumption.
Vulnerability Detail
In jose4j versions before 0.9.5, an attacker can exploit the library by crafting a malicious JWE token with an extremely high compression ratio. When the server processes this token, it can trigger significant memory allocation and prolonged processing times during decompression. This vulnerability can lead to a Denial-of-Service condition, effectively rendering the application unresponsive and impacting its availability.
How To Fix
Minimum fixed version
0.9.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to reject JWE tokens that exhibit unusually high compression ratios. This can help mitigate the risk of DoS attacks until the package is updated.
Conclusion
The jose4j library has a significant vulnerability that can lead to Denial-of-Service attacks through compressed JWE content. It is crucial to update to version 0.9.5 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for org.bitbucket.b_c:jose4j →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary impact is a Denial-of-Service condition, which can make your application unresponsive and affect its availability.
Yes, the vulnerability is patched in version 0.9.5 of the jose4j library. Updating to this version will resolve the issue.
If immediate updates are not possible, implement input validation to reject suspicious JWE tokens as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for org.bitbucket.b_c:jose4j.
