Connect2id Nimbus-JOSE-JWT is used by IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) as part of the openid authentication options. Connect2id Nimbus-JOSE-JWT is vulnerable to a denial of service, caused by improper validation of user requests by the PasswordBasedDecrypter (PBKDF2) component. By sending a specially crafted request using a large JWE p2c header, a remote attacker could exploit this vulnerability to cause a denial of service.
CVEID:CVE-2023-52428
**DESCRIPTION:**Connect2id Nimbus-JOSE-JWT is vulnerable to a denial of service, caused by improper validation of user requests by the PasswordBasedDecrypter (PBKDF2) component. By sending a specially crafted request using a large JWE p2c header, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/284044 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Product(s) | Version(s) |
---|---|
UCD - IBM UrbanCode Deploy | 7.1 - 7.1.2.17 |
UCD - IBM UrbanCode Deploy | 7.2 - 7.2.3.10 |
UCD - IBM UrbanCode Deploy | 7.3 - 7.3.2.5 |
UCD - IBM DevOps Deploy | 8.0 - 8.0.1.0 |
IBM strongly suggests the following:
Upgrade affected versions to any of 7.1.2.18, 7.2.3.11, 7.3.2.6, or 8.0.1.1 or later
None