PT-2023-31606 · Jose2Go+2 · Jose2Go+2

Published 2023-12-20 · Updated 2025-02-14 · CVE-2023-50658

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions jose2go versions prior to 1.6.0

Description The issue allows attackers to cause a denial of service, specifically CPU consumption, via a large p2c (also known as PBES2 Count) value in a PBES2 encrypted JWE blob. This can occur when an attacker-controlled input is decrypted, leading to the denial-of-service condition.

Recommendations For versions prior to 1.6.0, update to version 1.6.0 or later to resolve the issue. As a temporary workaround, consider restricting the decryption of PBES2 encrypted JWE blobs with large p2c values to minimize the risk of exploitation.

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

ALT-PU-2024-12202

ALT-PU-2024-12410

ALT-PU-2024-9408

ALT-PU-2024-9897

AZL-35422

AZL-35426

CVE-2023-50658

GHSA-6294-6RGP-FR7R

GHSA-MHPQ-9638-X6PW

GO-2023-2409

Affected Products

Alt Linux

Debian

Jose2Go

References · 20

• https://github.com/dvsekhvalnov/jose2go/commit/a4584e9dd7128608fedbc67892eba9697f0d5317 · Patch
• https://github.com/dvsekhvalnov/jose2go/compare/v1.5.0...v1.6.0 · Patch
• https://osv.dev/vulnerability/GHSA-mhpq-9638-x6pw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-50658 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50658 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-50658 · Security Note
• https://osv.dev/vulnerability/AZL-35422 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-50658 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-50658 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-50658 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35426 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6294-6rgp-fr7r · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-2409 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-50658 · Vendor Advisory
• https://github.com/dvsekhvalnov/jose2go/issues/31 · Note