PT-2023-8391 · Jose4J · Jose4J

Kanii · Publicado 2023-01-20 · Atualizado 2024-02-15 · CVE-2023-31582

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions jose4j versions prior to 0.9.3

Description The issue is related to the use of an algorithm that provides insufficient entropy. This allows attackers to set a low iteration count of 1000 or less, potentially enabling them to bypass security restrictions.

Recommendations For versions prior to 0.9.3, update to version 0.9.3 or later to resolve the issue. As a temporary workaround, consider increasing the PBES2 iteration count to a value greater than 1000 to minimize the risk of exploitation.

Correção

Use of a Broken Cryptographic Algorithm

Enumeração de Fraquezas

CWE-327

CWE-331

Identificadores relacionados

BDU:2024-00592

CVE-2023-31582

GHSA-7G24-QG88-P43Q

SUSE-SU-2024:0485-1

Produtos afetados

Jose4J

Referências · 68

• https://bugzilla.suse.com/1214077 · Nota
• https://bugzilla.suse.com/1216781 · Nota
• https://suse.com/security/cve/CVE-2023-32189 · Nota
• https://bugzilla.suse.com/1218019 · Nota
• https://bugzilla.suse.com/1218089 · Nota
• https://security-tracker.debian.org/tracker/CVE-2023-31582 · Aviso do Fabricante
• https://bugzilla.suse.com/1210911 · Nota
• https://github.com/KANIXB/JWTIssues/blob/main/jose4j%20issue.md · Nota
• https://bugzilla.suse.com/1218146 · Nota
• https://bugzilla.suse.com/1217869 · Nota
• https://bugzilla.suse.com/1215810 · Nota
• https://bugzilla.suse.com/1218094 · Nota
• https://oracle.com/security-alerts/cpujan2024.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-31582 · Nota de Segurança
• https://bugzilla.suse.com/1211912 · Nota