PT-2023-20213 · Node-Jose · Node-Jose

Parente95481A · Published 2023-02-16 · Updated 2023-02-24 · CVE-2023-25653

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions node-jose versions prior to 2.2.0

Description The issue is related to a Denial-of-Service (DoS) condition in the "fallback" crypto back-end of node-jose, which can be triggered by malicious input or randomly for some ECC operations. This condition is caused by a possible infinite loop in an internal calculation due to the jsbn modInverse function sometimes returning negative results. The affected elliptic curve algorithms include key generation, converting a private key to a public key, ECDSA signing and verification, and ECDH key agreement.

Recommendations For versions prior to 2.2.0, ensure that either WebCrypto or the Node crypto module is available in the JS environment where node-jose is being run to avoid the issue. Update to version 2.2.0 or later to resolve the issue.

Exploit

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2023-25653

GHSA-5H4J-QRVG-9XHW

Affected Products

Node-Jose

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25653.json · Exploit
• https://github.com/cisco/node-jose/commit/901d91508a70e3b9bdfc45688ea07bb4e1b8210d · Patch
• https://github.com/cisco/node-jose/security/advisories/GHSA-5h4j-qrvg-9xhw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25653 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25653 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5h4j-qrvg-9xhw · Vendor Advisory
• https://github.com/cisco/node-jose · Note