Denial of Service Vulnerability in libjose4j-java: CVE-2023-51775
Summary
UBUNTU-CVE-2023-51775: The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value. Affects libjose4j-java versions 0.7.7-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libjose4j-java is a Java library that provides functionality for JSON Web Encryption (JWE) and JSON Web Signature (JWS). It is widely used in applications that require secure data transmission and authentication. The library is designed to be flexible and supports various encryption algorithms. However, a vulnerability has been identified in versions prior to 0.9.4, which can lead to denial of service attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2023-51775, allows attackers to cause a denial of service by exploiting a large p2c (PBES2 Count) value. This can lead to excessive CPU consumption, potentially rendering the affected application unresponsive. The issue originates from improper handling of input values, which can be manipulated by an attacker to exhaust system resources. The CVSS score for this vulnerability is 6.5, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to restrict the p2c value to a safe range. This can help prevent the exploitation of the vulnerability until an official update can be applied.
Conclusion
CVE-2023-51775 is a significant vulnerability in the libjose4j-java library that can lead to denial of service attacks. It is crucial for users of this library to update to the latest patched versions to ensure the security and stability of their applications. Implementing workarounds can provide temporary relief until updates are applied.
See every vulnerability recorded for libjose4j-java →
FAQ
CVE-2023-51775 is a vulnerability in the libjose4j-java library that allows attackers to cause denial of service through excessive CPU consumption.
Versions prior to 0.9.4 of libjose4j-java are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement input validation to restrict the p2c value until you can apply the official patch.
The CVSS score for CVE-2023-51775 is 6.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libjose4j-java.
