GitHub Advisoryadvisory · Hex

GHSA-9mg4-v392-8j68 erlang-jose vulnerable to denial of service via large p2c value

MEDIUM Published 2024-03-19 Modified 2024-04-10 Official page ↗
Aliases
CVE-2023-50966
Ecosystem
Hex
Packages
jose
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-400
Reviewed
2024-04-08

Affected packages

• Hex jose: < 1.11.7 → fixed in 1.11.7

Description

erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value in a JOSE header.

Related

Alias · CVE (1)

  • CVE-2023-50966 erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References