ghsa-gvpg-vgmx-xg6w
Vulnerability from github
Published
2024-02-11 06:30
Modified
2024-03-15 14:23
Summary
Denial of Service in Connect2id Nimbus JOSE+JWT
Details
In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.
{ "affected": [ { "package": { "ecosystem": "Maven", "name": "com.nimbusds:nimbus-jose-jwt" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "9.37.2" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2023-52428" ], "database_specific": { "cwe_ids": [ "CWE-400" ], "github_reviewed": true, "github_reviewed_at": "2024-03-15T14:23:03Z", "nvd_published_at": "2024-02-11T05:15:08Z", "severity": "MODERATE" }, "details": "In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.", "id": "GHSA-gvpg-vgmx-xg6w", "modified": "2024-03-15T14:23:03Z", "published": "2024-02-11T06:30:27Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52428" }, { "type": "PACKAGE", "url": "https://bitbucket.org/connect2id/nimbus-jose-jwt" }, { "type": "WEB", "url": "https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e" }, { "type": "WEB", "url": "https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526" }, { "type": "WEB", "url": "https://connect2id.com/products/nimbus-jose-jwt" } ], "schema_version": "1.4.0", "severity": [], "summary": "Denial of Service in Connect2id Nimbus JOSE+JWT" }
Loading...