Описание
The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
A flaw was found in the jose.4.j (jose4j) library. The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its primary purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a large number, it can cause high computational consumption, resulting in a denial of service.
Отчет
The vulnerability in the jose4j library, where the "p2c" parameter in PBKDF2-based JWE key management algorithms can be manipulated to induce high computational consumption, is classified as moderate severity due to its potential impact on service availability and resource exhaustion. By setting a large value for "p2c", an attacker can force the server to perform an excessive number of PBKDF2 iterations during key derivation. This results in increased CPU and memory usage, potentially leading to degraded performance or temporary denial of service.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Developer Tools and Services | jenkins-2-plugins | Not affected | ||
| Red Hat build of Apache Camel for Spring Boot 3 | jose4j | Out of support scope | ||
| Red Hat build of Apache Camel for Spring Boot 4 | jose4j | Not affected | ||
| Red Hat build of Apache Camel - HawtIO 4 | jose4j | Affected | ||
| Red Hat build of Debezium 2 | jose4j | Not affected | ||
| Red Hat Build of Keycloak | jose4j | Affected | ||
| Red Hat build of Quarkus | org.bitbucket.b_c/jose4j | Affected | ||
| Red Hat Data Grid 8 | jose4j | Not affected | ||
| Red Hat Fuse 7 | jose4j | Will not fix | ||
| Red Hat Integration Camel K 1 | jose4j | Will not fix |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
The jose4j component before 0.9.4 for Java allows attackers to cause a ...
jose4j denial of service via specifically crafted JWE
Уязвимость JWT-библиотеки Jose4j, связанная с неправильной реализацией алгоритма PBES2 при обработке параметра p2c, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
7.5 High
CVSS3