GitHub Advisoryadvisory · Maven

GHSA-gvpg-vgmx-xg6w Denial of Service in Connect2id Nimbus JOSE+JWT

HIGH Published 2024-02-11 Modified 2024-10-30 Official page ↗
Aliases
CVE-2023-52428
Ecosystem
Maven
Packages
com.nimbusds:nimbus-jose-jwt
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-770
Reviewed
2024-03-15

Affected packages

• Maven com.nimbusds:nimbus-jose-jwt: < 9.37.2 → fixed in 9.37.2

Description

In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.

Related

Alias · CVE (1)

  • CVE-2023-52428 In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header… vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References