The vulnerability of the Jose4j JWT library, related to the use of an algorithm that provides insufficient entropy, allows attackers to circumvent security restrictions.

🗓️ 24 Jan 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 6 Views

Jose4j JSON Web Token library uses an algorithm with insufficient entropy, enabling remote bypass.

Reporter	Title	Published	Views	Family All 41
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM protocols are vulnerable to information exposure and denial of service (CVE-2023-31582, CVE-2023-51775)	15 May 202408:36	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Operations Analytics Predictive Insights.	27 Mar 202415:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics is affected but not classified as vulnerable to vulnerabilities in multiple Open Source Software (OSS) components	5 Feb 202418:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling B2B Integrator is affected by multiple security vulnerabilities in IBM WebSphere Application Server	4 Dec 202415:14	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities exists in IBM Netezza Performance Server Replication Services	24 Sep 202509:37	–	ibm
IBM Security Bulletins	Security Bulletin: Information Disclosure vulnerability affect IBM Business Automation Workflow - CVE-2023-31582	2 Feb 202410:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities	11 Dec 202418:44	–	ibm
ATTACKERKB	CVE-2023-31582	25 Oct 202318:17	–	attackerkb
Chainguard	CVE-2023-31582 vulnerabilities	10 Feb 202619:17	–	cgr
Circl	CVE-2023-31582	7 Feb 202417:41	–	circl

Vulners

Node

red_hat red_hat_process_automationMatch7

OR

red_hat red_hat_data_gridMatch8.4.6

OR

red_hat red_hat_amq_streamsMatch2.6.0

OR

oracle oracle_communications_cloud_native_core_unified_data_repositoryMatch23.3.1

OR

oracle oracle_communications_cloud_native_core_network_repository_functionMatch23.1.4

OR

oracle oracle_communications_cloud_native_core_network_repository_functionMatch23.3.1

OR

oracle communications_cloud_native_core_network_exposure_functionMatch23.3.1

Source	Link
safe-surf	www.safe-surf.ru/upload/VULN-new/VULN.2024-01-19.1.pdf
access	www.access.redhat.com/security/cve/cve-2023-31582
bitbucket	www.bitbucket.org/b_c/jose4j/issues/203/insecure-support-of-setting-pbe-less-then
github	www.github.com/KANIXB/JWTIssues/blob/main/jose4j%20issue.md
oracle	www.oracle.com/security-alerts/cpujan2024.html
oracle	www.oracle.com/security-alerts/cpujan2024verbose.html
web	www.web.nvd.nist.gov/view/vuln/detail

17 Apr 2024 00:00Current

6.9Medium risk

Vulners AI Score6.9

CVSS 37.5

CVSS 27.8

EPSS0.00644

Jose4j JSON Web Token insufficient entropy remote bypass security vulnerability