GitHub Advisoryadvisory · Go

GHSA-2c7c-3mj9-8fqh Decryption of malicious PBES2 JWE objects can consume unbounded system resources

MEDIUM Published 2023-11-21 Modified 2024-05-20 Official page ↗
Ecosystem
Go
Packages
github.com/go-jose/go-jose/v3, github.com/square/go-jose
Severity
Moderate
Weaknesses
CWE-400
Reviewed
2023-11-21

Affected packages

• Go github.com/go-jose/go-jose/v3: < 3.0.1 → fixed in 3.0.1 • Go github.com/square/go-jose: < 2.6.2 → fixed in 2.6.2

Description

The go-jose package is subject to a "billion hashes attack" causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-service.

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References