Описание
The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| libjose4j-java | fixed | 0.9.6-1 | package |
Примечания
https://bitbucket.org/b_c/jose4j/issues/212
https://bitbucket.org/b_c/jose4j/commits/1afaa1e174b3 (jose4j-0.9.4)
Связанные уязвимости
The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
jose4j denial of service via specifically crafted JWE
Уязвимость JWT-библиотеки Jose4j, связанная с неправильной реализацией алгоритма PBES2 при обработке параметра p2c, позволяющая нарушителю вызвать отказ в обслуживании