The go-jose package before 3.0.1 is subject to a "billion hashes attack" causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-service.
WS-2023-0431 - Medium Severity Vulnerability
An implementation of JOSE standards (JWE, JWS, JWT) in Go
Library home page: https://proxy.golang.org/github.com/square/go-jose/@v/v2.0.1+incompatible.zip
Dependency Hierarchy: - :x: **github.com/square/go-jose-v2.0.1** (Vulnerable Library)
Found in HEAD commit: 9505f4ca92405cc9273dc3726c2d274ce28a4407
Found in base branch: ALL_HANDS/major-secrets
The go-jose package before 3.0.1 is subject to a "billion hashes attack" causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-service.
Publish Date: 2023-11-22
URL: WS-2023-0431
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/advisories/GHSA-2c7c-3mj9-8fqh
Release Date: 2023-11-22
Fix Resolution: v3.0.1
Step up your Open Source Security Game with Mend here