Duplicate Advisory: Denial of service when decrypting attack controlled input in github.com/dvsekhvalnov/jose2go

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6294-6rgp-fr7r. This link is maintained to preserve external references. Original Description An attacker controlled input of a PBES2 encrypted JWE blob can have a very large p2c value that, when decrypted,...

GO-2023-2409 Denial of service when decrypting attacker controlled input in github.com/dvsekhvalnov/jose2go

An attacker controlled input of a PBES2 encrypted JWE blob can have a very large p2c value that, when decrypted, produces a denial-of-service...

PT-2023-31606 · Jose2Go +2 · Jose2Go +2

Name of the Vulnerable Software and Affected Versions: jose2go versions prior to 1.6.0 Description: The issue allows attackers to cause a denial of service, specifically CPU consumption, via a large p2c also known as PBES2 Count value in a PBES2 encrypted JWE blob. This can occur when an...

Denial Of Service (DoS)

github.com/go-jose/go-jose is vulnerable to Billion Hashes Attack. The vulnerability is due to the decryptKey function in symmetric.go because it only checks if the value of p2c is a positive integer, but lacks a maximum size check. This allow an attacker to provide a PBES2 encrypted JWE blob wit...