CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
EPSS
Percentile
65.9%
libcjose.so is vulnerable to weak encryption. The vulnerability exists in jwe.c
because it does not properly validate the authentication tag according to the spec, which may allow an attacker to access unauthorized information in the system by modifying the JWE.
datatracker.ietf.org/doc/html/rfc7518#section-4.7
github.com/cisco/cjose/blob/0.6.1/src/jwe.c#L1228-L1229
github.com/OpenIDC/cjose/commit/7325e9a5e71e2fc0e350487ecac7d84acdf0ed5e
github.com/OpenIDC/cjose/releases/tag/v0.6.2.2
github.com/OpenIDC/cjose/security/advisories/GHSA-3rhg-3gf2-6xgj
lists.debian.org/debian-lts-announce/2023/08/msg00002.html
lists.fedoraproject.org/archives/list/[email protected]/message/DFWAPMYYVBO2U65HPYDTBEKNSXG4TP5C/
lists.fedoraproject.org/archives/list/[email protected]/message/LCQJXKDPCWCXB2V4JMQ3UWYJ4UIBPUW6/
lists.fedoraproject.org/archives/list/[email protected]/message/PTZHOVGY7AHGNMEY245HK4Q36AMA53AL/
www.debian.org/security/2023/dsa-5472