Unknown · Lestrrat-Go/Jwx · CVE-2023-49290
**Name of the Vulnerable Software and Affected Versions**
lestrrat-go/jwx versions prior to 1.2.27
lestrrat-go/jwx versions prior to 2.0.18
**Description**
The issue is related to the JWE key management algorithms based on PBKDF2, which require a JOSE Header Parameter called `p2c` (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its primary purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the `p2c` parameter in JWE to a very large number, it can cause excessive computational consumption, resulting in a denial of service.
**Recommendations**
For versions prior to 1.2.27, upgrade to version 1.2.27 or later.
For versions prior to 2.0.18, upgrade to version 2.0.18 or later.
As a temporary workaround, consider restricting the use of the `p2c` parameter in JWE to minimize the risk of exploitation.