PT-2023-20213 · Node-Jose · Node-Jose

Parente95481A · Publicado 2023-02-16 · Atualizado 2023-02-24 · CVE-2023-25653

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions node-jose versions prior to 2.2.0

Description The issue is related to a Denial-of-Service (DoS) condition in the "fallback" crypto back-end of node-jose, which can be triggered by malicious input or randomly for some ECC operations. This condition is caused by a possible infinite loop in an internal calculation due to the jsbn modInverse function sometimes returning negative results. The affected elliptic curve algorithms include key generation, converting a private key to a public key, ECDSA signing and verification, and ECDH key agreement.

Recommendations For versions prior to 2.2.0, ensure that either WebCrypto or the Node crypto module is available in the JS environment where node-jose is being run to avoid the issue. Update to version 2.2.0 or later to resolve the issue.

Exploit

Correção

Infinite Loop

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

CVE-2023-25653

GHSA-5H4J-QRVG-9XHW

Produtos afetados

Node-Jose

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25653.json · Exploit
• https://github.com/cisco/node-jose/commit/901d91508a70e3b9bdfc45688ea07bb4e1b8210d · Correção
• https://github.com/cisco/node-jose/security/advisories/GHSA-5h4j-qrvg-9xhw · Aviso do Fabricante
• https://github.com/cisco/node-jose · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-25653 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-25653 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-5h4j-qrvg-9xhw · Aviso do Fabricante