Jose · Jose · CVE-2021-29443
Name of the Vulnerable Software and Affected Versions:
jose versions prior to 1.28.1
jose versions prior to 2.0.5
jose versions prior to 3.11.4
Description:
The issue concerns the AES CBC HMAC SHA2 Algorithm, where a possibly observable difference in timing when a padding error occurs during decryption makes a padding oracle. An adversary might be able to use this oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle, where b is the number of bytes in the ciphertext block.
Recommendations:
For versions prior to 1.28.1, upgrade the dependency to ^1.28.1.
For versions prior to 2.0.5, upgrade the dependency to ^2.0.5.
For versions prior to 3.11.4, upgrade the dependency to ^3.11.4.