PT-2023-7638 · Unknown · Lestrrat-Go/Jwx
P3Ngu1Nw
·
Publicado
2023-12-03
·
Atualizado
2024-03-04
·
CVE-2023-49290
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
lestrrat-go/jwx versions prior to 1.2.27
lestrrat-go/jwx versions prior to 2.0.18
Description
The issue is related to the JWE key management algorithms based on PBKDF2, which require a JOSE Header Parameter called
p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its primary purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption, resulting in a denial of service.Recommendations
For versions prior to 1.2.27, upgrade to version 1.2.27 or later.
For versions prior to 2.0.18, upgrade to version 2.0.18 or later.
As a temporary workaround, consider restricting the use of the
p2c parameter in JWE to minimize the risk of exploitation.Exploit
Correção
Resource Exhaustion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Lestrrat-Go/Jwx