Denial of Service Vulnerability in libjose4j-java: CVE-2023-51775
Summary
DEBIAN-CVE-2023-51775: The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value. Affects libjose4j-java versions < 0.9.6-1. Fixed in 0.9.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libjose4j-java is a Java library that provides support for JSON Object Signing and Encryption (JOSE) standards. It is widely used in applications that require secure data transmission and authentication. The library allows developers to implement cryptographic operations with ease, but it has been found to have a significant vulnerability that can lead to denial of service attacks.
Vulnerability Detail
The vulnerability identified as CVE-2023-51775 affects versions of libjose4j-java prior to 0.9.4. It allows attackers to exploit the library by sending a large PBES2 Count value, which can lead to excessive CPU consumption. This can result in denial of service, making the application unresponsive and potentially affecting other services running on the same server. The issue arises from inadequate input validation and handling of large values, which can overwhelm the system resources.
How To Fix
Minimum fixed version
0.9.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libjose4j-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update the package immediately, consider implementing input validation to restrict the size of the PBES2 Count value in your application. This can help mitigate the risk of denial of service attacks until you can apply the official patch.
Conclusion
The CVE-2023-51775 vulnerability in libjose4j-java poses a significant risk of denial of service due to excessive CPU consumption from large PBES2 Count values. It is crucial to update to the patched version 0.9.6-1 to mitigate this risk. In the meantime, consider implementing input validation as a workaround.
See every vulnerability recorded for libjose4j-java →
FAQ
CVE-2023-51775 is a vulnerability in the libjose4j-java library that allows for denial of service attacks through excessive CPU consumption.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring sign-up.
The primary consequence is denial of service, where an attacker can make the application unresponsive, affecting user experience and potentially other services.
Yes, a patch is available in version 0.9.6-1 of the libjose4j-java package. It is recommended to update to this version or later.
If immediate updating is not possible, implement input validation to limit the size of PBES2 Count values in your application as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for libjose4j-java.
