Denial of Service Vulnerability in libjose4j-java: Large PBES2 Count Value
Summary
CVE-2023-51775: The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value. Affects libjose4j-java across 2 version ranges.
< 0.9.6-1
< 055225eae37ff00b9636376de292bd5848219a31
Fixed in 0.9.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libjose4j-java is a Java library that provides support for JSON Web Encryption (JWE) and JSON Web Signature (JWS). It is widely used for secure data transmission and authentication in Java applications. The library allows developers to implement cryptographic operations easily, but it has been found to be vulnerable to a denial of service attack due to improper handling of large PBES2 Count values, which can lead to excessive CPU consumption.
Vulnerability Detail
The vulnerability identified as CVE-2023-51775 affects the jose4j component before version 0.9.4. Attackers can exploit this vulnerability by providing a large PBES2 Count value, which causes the application to consume an excessive amount of CPU resources. This can lead to a denial of service, making the application unresponsive and potentially affecting other services running on the same server. The issue arises from the way the library processes these large values without adequate validation or limits.
How To Fix
Minimum fixed version
0.9.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libjose4j-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not possible, consider implementing input validation in your application to restrict the PBES2 Count values to a safe range. This can be done by checking the input before passing it to the jose4j library. For example, you can add a check like this in your code: if (pbes2Count < MIN_VALUE || pbes2Count > MAX_VALUE) { throw new
IllegalArgumentException('Invalid PBES2 Count value');
}
Conclusion
The CVE-2023-51775 vulnerability in libjose4j-java poses a significant risk of denial of service due to improper handling of large PBES2 Count values. It is crucial for developers using this library to update to version 0.9.4 or later to mitigate this risk. Implementing input validation can serve as a temporary workaround until an update can be applied.
See every vulnerability recorded for libjose4j-java →
FAQ
CVE-2023-51775 is a vulnerability in the jose4j component that allows attackers to cause a denial of service by providing a large PBES2 Count value.
If you are using a version of libjose4j-java prior to 0.9.4, your application may be vulnerable. You can check your package version or use tools like Vulert to monitor for vulnerabilities.
The primary consequence is denial of service, where the application may become unresponsive due to excessive CPU consumption caused by large PBES2 Count values.
Yes, you can implement input validation to restrict PBES2 Count values to a safe range as a temporary workaround.
More information can be found in the official CVE database or by visiting the Vulert website, which provides real-time monitoring for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for libjose4j-java.
