Important: cjose security update
Summary
ALSA-2023:4411: Important: cjose security update. Affects cjose versions < 0.6.1-13.el9_2.alma. Fixed in 0.6.1-13.el9_2.alma. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CJose is a C library that implements the Javascript Object Signing and Encryption (JOSE) standard. JOSE provides a framework for securely transmitting and manipulating JSON objects. The cjose library is widely used in various applications for cryptographic operations such as signing, encryption, and decryption.
Vulnerability Detail
The vulnerability identified in cjose is related to the AES GCM decryption process. The library incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE (JSON Web Encryption) data. This flaw could potentially lead to security issues, including the possibility of unauthorized access to sensitive information. The vulnerability has been assigned the CVE identifier CVE-2023-37464.
How To Fix
Minimum fixed version
0.6.1-13.el9_2.alma
This is the first release that contains the fix.
sudo dnf update cjoseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update provided by the cjose library to mitigate the risk effectively.
Conclusion
It is highly recommended to update the cjose library to the latest version to address the AES GCM decryption vulnerability. Failure to do so may expose cryptographic operations to potential security risks. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cjose →
FAQ
Cjose is a C library that implements the JOSE standard, which provides a framework for secure JSON object signing and encryption.
The vulnerability in cjose could potentially allow unauthorized access to sensitive information, compromising the security of cryptographic operations.
To fix this vulnerability, update the cjose library to version 0.6.1-13.el9_2.alma or later.
No, there is no known workaround for this vulnerability. It is crucial to apply the provided security update.
You can find more information about this vulnerability in the CVE page with the identifier CVE-2023-37464.
Related vulnerabilities
Recent vulnerabilities recorded for cjose.
