UBUNTU-CVE-2025-9230

Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a...

latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

...

Astra Linux – Vulnerability in Jose

Latchset JOSE with version 11 allows attackers to cause a denial of service CPU consumption by using a large p2c value also known as PBES2 Count...

OESA-2024-1471 jose security update

José is a C-language implementation of the Javascript Object Signing and Encryption standards. José provides a command-line utility which encompasses most of the JOSE features. This allows for easy integration into your project and one-off scripts. Security Fixes: latchset jose through version 11...

AZL-43528 CVE-2023-50967 affecting package jose 10-7

latchset jose through version 11 allows attackers to cause a denial of service CPU consumption via a large p2c aka PBES2 Count value...

DEBIAN-CVE-2023-50966

erlang-jose aka JOSE for Erlang and Elixir through 1.11.6 allow attackers to cause a denial of service CPU consumption via a large p2c aka PBES2 Count value in a JOSE header...

AZL-39857 CVE-2023-50966 affecting package rabbitmq-server for versions less than 3.11.24-2

erlang-jose aka JOSE for Erlang and Elixir through 1.11.6 allow attackers to cause a denial of service CPU consumption via a large p2c aka PBES2 Count value in a JOSE header...

jose Security Vulnerabilities

jose is a JavaScript module for signing and encrypting JSON objects. A security vulnerability exists in jose 1.11.6 and earlier versions that could allow an attacker to cause a denial of service via the PBES2 Count value in the JOSE header...

The vulnerability of the Jose4j JWT library, related to the incorrect implementation of the PBES2 algorithm when processing the p2c parameter, allows a violator to trigger a service failure.

The vulnerability of the Jose4j JWT library is related to the incorrect implementation of the PBES2 algorithm when processing the p2c parameter. Exploiting this vulnerability can allow an attacker who operates remotely to cause a service failure...

The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

...

PT-2023-31606 · Jose2Go +2 · Jose2Go +2

Name of the Vulnerable Software and Affected Versions: jose2go versions prior to 1.6.0 Description: The issue allows attackers to cause a denial of service, specifically CPU consumption, via a large p2c also known as PBES2 Count value in a PBES2 encrypted JWE blob. This can occur when an...

The vulnerability of the PBES2 encryption algorithm in the jwx library allows a perpetrator to cause a service failure.

The vulnerability of the PBES2 encryption algorithm in the jwx library is related to an uncontrolled resource consumption during the processing of the p2c parameter, which determines the number of iterations required to obtain the key. Exploiting this vulnerability could allow a remote attacker t...

Weak Cryptography

jose4j is vulnerable to Weak Cryptography. The vulnerability is present in Pbes2HmacShaWithAesKeyWrapAlgorithm.java due to the ability to set a small iteration count when using the PBE Password-Based Encryption algorithm. This weakness enables an attacker to determine hashed password values...

PT-2023-8391 · Jose4J · Jose4J

Name of the Vulnerable Software and Affected Versions: jose4j versions prior to 0.9.3 Description: The issue is related to the use of an algorithm that provides insufficient entropy. This allows attackers to set a low iteration count of 1000 or less, potentially enabling them to bypass security...

DEBIAN-CVE-2022-36083

JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c PBES2 Count, which determine...

jose 资源管理错误漏洞

npm jose is an application from the U.S. company npm. Use native encryption runtime does not depend on the item JWA, JWS, JWE, JWT, JWK. A resource management error vulnerability exists in jose versions prior to v1.28.2, prior to v2.0.6, prior to v3.20.4, and prior to v4.9.2, which stems from the...

PT-2022-23172

Name of the Vulnerable Software and Affected Versions JOSE versions prior to v1.28.2 JOSE versions prior to v2.0.6 JOSE versions prior to v3.20.4 JOSE versions prior to v4.9.2 Description The PBKDF2-based JWE key management algorithms in JOSE expect a JOSE Header Parameter named p2c PBES2 Count,...

Mageia: Security Advisory (MGASA-2017-0460)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for java-1.7.0-openjdk (EulerOS-SA-2017-1330)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Broadcom Brocade SANnav Encryption Issue Vulnerability

Broadcom Brocade SANnav is a suite of SAN management platforms from Broadcom USA. A security vulnerability exists in the encryption key generation process in the PBE algorithm of Broadcom Brocade SANnav versions prior to 2.0. An attacker can exploit this vulnerability to decrypt passwords...