Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to denial of service due to CVE-2022-36083

Summary Node.js module jose is used by IBM App Connect Enterprise Certified Container for securing internal communications and in connections by connectors to SaaS endpoints. IBM App Connect Enterprise Certified Container operands may be vulnerable to denial of service. This bulletin provides pat...

Wallarm at API World and KubeCon 2022 this week

This is a busy week for the whole Wallarm team as we are sponsoring two big conferences at the very same time. API World 2022 Wallarm will be at API World in San Jose starting today. Stop by booth 209 to chat with our apisecurity experts about everything APIs, and check out a demo of Wallarm WAAP...

Security Bulletin: Vulnerability in the Node.js jose module affects IBM Event Streams (CVE-2022-36083)

Summary This security vulnerability affects the Node.js jose module that is used by IBM Event Streams. Vulnerability Details CVEID:CVE-2022-36083 DESCRIPTION: Node.js jose module is vulnerable to a denial of service, caused by improper input validation. By sending a specially-crafted request usin...

cortex-cli (>=2.0.8 <=2.1.1) potentially affected by CVE-2022-36083 via jose-node-cjs-runtime (>=4.10.0 <=4.8.1)

jose-node-cjs-runtime NPM version =4.10.0, =2.0.8, =2.1.1 Source cves: CVE-2022-36083 Source advisory: OSV:GHSA-JV3G-J58F-9MQ9...

cortex-cli (=2.0.7) potentially affected by CVE-2022-36083 via jose-node-cjs-runtime (=3.18.0)

jose-node-cjs-runtime NPM version =3.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on jose-node-cjs-runtime and may be impacted: - cortex-cli =2.0.7 Source cves: CVE-2022-36083 Source advisory: OSV:GHSA-JV3G-J58F-9MQ9...

@netceterapx/click-to-pay-embedded-sdk (>=0.0.1 <=1.0.5), postman-helper (>=1.0.0 <=1.0.2) potentially affected by CVE-2022-36083 via jose-browser-runtime (>=4.15.5 <=4.1.2)

jose-browser-runtime NPM version =4.15.5, =0.0.1, =1.0.0, =1.0.2 Source cves: CVE-2022-36083 Source advisory: OSV:GHSA-JV3G-J58F-9MQ9...

@teachbase/utils (=1.0.1) potentially affected by CVE-2022-36083 via jose-browser-runtime (=3.16.1)

jose-browser-runtime NPM version =3.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on jose-browser-runtime and may be impacted: - @teachbase/utils =1.0.1 Source cves: CVE-2022-36083 Source advisory: OSV:GHSA-JV3G-J58F-9MQ9...

@decentralized-identity/ion-sdk (>=0.1.0 <=0.4.1), @tadashi/jwt (>=6.0.0 <=7.0.0) +21 more potentially affected by CVE-2022-36083 via jose (>=2.0.1 <=2.0.5)

jose NPM version =2.0.1, =0.1.0, =6.0.0, =3.0.4, =3.0.4, =3.0.5, =3.0.4, =3.0.5, =3.0.4, =3.0.6, =3.0.3, =3.0.5, =3.1.0, =2.3.2, =0.1.0, =1.2.4 and more Source cves: CVE-2022-36083 Source advisory: OSV:GHSA-JV3G-J58F-9MQ9...

@dci-lint/cmd-api-server (>=0.3.0 <=0.4.0), @dci-lint/test-api-client (>=0.3.0 <=0.4.0) +46 more potentially affected by CVE-2022-36083 via jose (>=1.18.1 <=1.28.1)

jose NPM version =1.18.1, =0.3.0, =0.3.0, =0.3.0, =0.10.0-unstable.2b529f0, =0.6.1, =0.6.3, =0.6.3, =0.6.4, =0.6.3, =0.6.9, =0.6.1, =0.6.3, =0.6.3, =0.6.3, =0.6.5, =0.9.4 and more Source cves: CVE-2022-36083 Source advisory: OSV:GHSA-JV3G-J58F-9MQ9...

@dci-lint/cmd-api-server (>=0.5.0 <=0.6.1), @dci-lint/test-api-client (>=0.5.0 <=0.6.1) +38 more potentially affected by CVE-2022-36083 via jose (>=3.11.6 <=3.20.3)

jose NPM version =3.11.6, =0.5.0, =0.5.0, =0.5.0, =0.1.0, =0.1.0, =0.0.3-3.12.3, =1.8.2-feat1608-jose3-915162334-6607-1623076209.0, =1.8.2-feat1608-jose3-915162334-6607-1623076209.0, =1.8.2-feat1608-jose3-915162334-6607-1623076209.0, =1.8.2-feat1608-jose3-915162334-6607-1623076209.0, =8.1.0,...

0xble (=14.1.0), 10minions-engine (>=0.0.1 <=0.0.4) +7441 more potentially affected by CVE-2022-36083 via jose (>=4.0.3 <=4.9.1)

jose NPM version =4.0.3, =0.0.1, =1.0.0, =0.1.0, =1.0.22, =0.1.0, =0.1.1, =0.0.1, =0.4.0, =0.4.0, =1.0.2, =1.0.0, =0.0.1, =1.1.4, =1.1.24 and more Source cves: CVE-2022-36083 Source advisory: OSV:GHSA-JV3G-J58F-9MQ9...

JOSE vulnerable to resource exhaustion via specifically crafted JWE

The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c PBES2 Count, which determines how many PBKDF2 iterations must be executed in order to derive a CEK wrapping key. The purpose of this parameter is to intentionally slow down the key derivation function in order...

Malicious Package

Overview jose-openid-client is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packag...

Denial Of Service (DoS)

jose is vulnerable to denial of service. The vulnerability exists in the multiple functions in decrypt.ts due to not limiting the computational expense of default PBES2 algorithm, allowing an attacker to crash the application by providing malicious input...

CVE-2022-36083

JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c PBES2 Count, which determine...

Default credentials

JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c PBES2 Count, which determine...

CVE-2022-36083

JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c PBES2 Count, which determine...

CVE-2022-36083 JOSE vulnerable to resource exhaustion via specifically crafted JWE

JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c PBES2 Count, which determine...

CVE-2022-36083

CVE-2022-36083 affects the Node.js jose module (JWA/JWS/JWE/JWT/JWK/JWKS) used in multiple runtimes. The issue arises from a JOSE Header parameter p2c (PBES2 count) that controls PBKDF2 iterations for deriving the CEK. A malicious untrusted JWE could specify an extremely high p2c, causing CPU-bou...

CVE-2022-36083 JOSE vulnerable to resource exhaustion via specifically crafted JWE

JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c PBES2 Count, which determine...