PT-2023-7638 · Unknown · Lestrrat-Go/Jwx
P3Ngu1Nw
·
Published
2023-12-03
·
Updated
2024-03-04
·
CVE-2023-49290
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
lestrrat-go/jwx versions prior to 1.2.27
lestrrat-go/jwx versions prior to 2.0.18
Description
The issue is related to the JWE key management algorithms based on PBKDF2, which require a JOSE Header Parameter called
p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its primary purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption, resulting in a denial of service.Recommendations
For versions prior to 1.2.27, upgrade to version 1.2.27 or later.
For versions prior to 2.0.18, upgrade to version 2.0.18 or later.
As a temporary workaround, consider restricting the use of the
p2c parameter in JWE to minimize the risk of exploitation.Exploit
Fix
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Lestrrat-Go/Jwx