PT-2023-8391 · Jose4J · Jose4J

Kanii · Published 2023-01-20 · Updated 2024-02-15 · CVE-2023-31582

Positive Technologies · (AI Summary)

CVSS v2.0

7.8

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions jose4j versions prior to 0.9.3

Description The issue is related to the use of an algorithm that provides insufficient entropy. This allows attackers to set a low iteration count of 1000 or less, potentially enabling them to bypass security restrictions.

Recommendations For versions prior to 0.9.3, update to version 0.9.3 or later to resolve the issue. As a temporary workaround, consider increasing the PBES2 iteration count to a value greater than 1000 to minimize the risk of exploitation.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

CWE-331

Related Identifiers

BDU:2024-00592

CVE-2023-31582

GHSA-7G24-QG88-P43Q

SUSE-SU-2024:0485-1

Affected Products

Jose4J

References · 68

• https://ubuntu.com/security/CVE-2023-31582 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7g24-qg88-p43q · Vendor Advisory
• https://safe-surf.ru/upload/VULN-new/VULN.2024-01-19.1.pdf · Security Note
• https://osv.dev/vulnerability/CVE-2023-31582 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-31582 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:0485-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-31582 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00592 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-31582 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31582 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-31582 · Vendor Advisory
• https://bugzilla.suse.com/1219151 · Note
• https://bugzilla.suse.com/1211560 · Note
• https://bugzilla.suse.com/1218849 · Note
• https://bugzilla.suse.com/1216437 · Note