Critical Performance Degradation in node-jose Package Due to JWE Decryption Vulnerability
Summary
UBUNTU-CVE-2024-28176: jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. Affects node-jose versions 4.3.7+ds-1 – 4.5.0+ds-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-jose package is a JavaScript module designed for JSON Object Signing and Encryption. It provides essential functionalities such as support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), and JSON Web Key Set (JWKS). This package is widely used in applications requiring secure data transmission and authentication. However, it has recently been identified to have a vulnerability that can lead to significant performance issues under specific conditions.
Vulnerability Detail
A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces of the node-jose package. This issue arises from the handling of decompression of plaintext after decryption. Under certain circumstances, an attacker could exploit this vulnerability to cause the user's environment to consume an unreasonable amount of CPU time or memory during JWE decryption operations. This could lead to denial-of-service conditions, severely impacting application performance and user experience. The vulnerability has been assigned the identifier CVE-2024-28176 and has a CVSS score of 4.9, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not feasible, consider implementing rate limiting on JWE decryption operations to mitigate the impact of potential abuse. Additionally, ensure that input validation is performed to prevent malformed JWE tokens from being processed.
Conclusion
The node-jose package has a critical vulnerability related to JWE decryption that can lead to significant performance degradation. It is crucial to update to the patched version to mitigate risks. Users should also consider workarounds if immediate updates are not possible.
See every vulnerability recorded for node-jose →
FAQ
node-jose is a JavaScript module that provides functionalities for JSON Object Signing and Encryption, including support for JWT, JWS, JWE, JWK, and JWKS.
The vulnerability allows for excessive CPU and memory usage during JWE decryption, potentially leading to denial-of-service conditions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement rate limiting on JWE decryption operations and ensure proper input validation to mitigate the effects of the vulnerability.
The CVSS score of this vulnerability is 4.9, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for node-jose.
