Описание
In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.
A vulnerability was found in the Nimbus Jose JWT package. By crafting a JWE with an excessively large p2c value, an attacker can trigger significant resource consumption during decryption, potentially leading to application slowdown or unavailability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 3 | nimbus-jose-jwt | Not affected | ||
| Logging Subsystem for Red Hat OpenShift | com.nimbusds/nimbus-jose-jwt | Will not fix | ||
| Red Hat AMQ Broker 7 | nimbus-jose-jwt | Will not fix | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | nimbus-jose-jwt | Not affected | ||
| Red Hat build of Apache Camel for Spring Boot 3 | nimbus-jose-jwt | Affected | ||
| Red Hat build of Apache Camel - HawtIO 4 | nimbus-jose-jwt | Affected | ||
| Red Hat build of Apicurio Registry 2 | com.nimbusds/nimbus-jose-jwt | Not affected | ||
| Red Hat Build of Keycloak | nimbus-jose-jwt | Not affected | ||
| Red Hat build of Quarkus | nimbus-jose-jwt | Not affected | ||
| Red Hat Fuse 7 | nimbus-jose-jwt | Will not fix |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.
Denial of Service in Connect2id Nimbus JOSE+JWT
Уязвимость компонента PasswordBasedDecrypter Java-библиотеки Nimbus JOSE + JWT, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
7.5 High
CVSS3