Bug 2266921 (CVE-2023-51775)

Summary: CVE-2023-51775 jose4j: denial of service via specially crafted JWE
Product: [Other] Security Response Reporter: Rohit Keshri <rkeshri>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abrianik, aileenc, anstephe, ant, anujha, asatyam, aschwart, asoldano, aszczucz, avibelli, bbaranow, bgeorges, bmaxwell, boliveir, brian.stansberry, bstansbe, ccranfor, cescoffi, chazlett, chfoley, clement.escoffier, cmiranda, dandread, darran.lofthouse, dhanak, diagrawa, dkreling, dlofthou, dosoudil, drichtar, drosa, dsimansk, eric.wittmann, fmariani, ggrzybek, gmalinko, gsmet, ibek, istudens, ivassile, iweiss, janstey, jmartisk, jpechane, jpoth, jraez, jrokos, jwon, kingland, kverlaen, lthon, manderse, matzew, max.andersen, mcarlett, mnovotny, mosmerov, mposolda, msochure, mstefank, msvehla, mulliken, nwallace, olubyans, pantinor, parichar, pberan, pcongius, pdelbell, pdrozd, peholase, pesilva, pgallagh, pierdipi, pjindal, pmackay, probinso, pskopek, rguimara, rhuss, rmartinc, rowaters, rruss, rstancel, rstepani, rsvoboda, sabiswas, sausingh, sbiarozk, smaestri, ssilvert, sthorger, swoodman, tasato, tcunning, thjenkin, tom.jenkinson, tqvarnst, trathi, vdosoudi, vmuzikar, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: jose4j 0.9.4 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the jose.4.j (jose4j) library. The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its primary purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a large number, it can cause high computational consumption, resulting in a denial of service.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2266927    

Description Rohit Keshri 2024-02-29 08:52:25 UTC
The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

https://bitbucket.org/b_c/jose4j/issues/212

Comment 6 errata-xmlrpc 2024-06-03 11:53:52 UTC
This issue has been addressed in the following products:

  HawtIO 4.0.0 for Red Hat build of Apache Camel 4

Via RHSA-2024:3550 https://access.redhat.com/errata/RHSA-2024:3550

Comment 8 errata-xmlrpc 2024-06-24 01:38:51 UTC
This issue has been addressed in the following products:

  RHOSS-1.33-RHEL-8

Via RHSA-2024:4057 https://access.redhat.com/errata/RHSA-2024:4057

Comment 9 errata-xmlrpc 2024-07-08 20:04:48 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2024:4386 https://access.redhat.com/errata/RHSA-2024:4386

Comment 10 errata-xmlrpc 2024-07-08 22:19:10 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2024:4392 https://access.redhat.com/errata/RHSA-2024:4392

Comment 13 errata-xmlrpc 2024-07-25 15:04:53 UTC
This issue has been addressed in the following products:

  Red Hat build of Apicurio Registry 2.6.1 GA

Via RHSA-2024:4873 https://access.redhat.com/errata/RHSA-2024:4873

Comment 14 errata-xmlrpc 2024-10-14 17:59:07 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

Via RHSA-2024:8077 https://access.redhat.com/errata/RHSA-2024:8077

Comment 15 errata-xmlrpc 2024-10-14 17:59:45 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2024:8076 https://access.redhat.com/errata/RHSA-2024:8076

Comment 16 errata-xmlrpc 2024-10-14 18:00:29 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Via RHSA-2024:8075 https://access.redhat.com/errata/RHSA-2024:8075

Comment 17 errata-xmlrpc 2024-10-14 18:07:06 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2024:8080 https://access.redhat.com/errata/RHSA-2024:8080

Comment 22 errata-xmlrpc 2025-03-07 11:29:41 UTC
This issue has been addressed in the following products:

  Red Hat AMQ Streams 2.5.2

Via RHSA-2024:6536 https://access.redhat.com/errata/RHSA-2024:6536

Comment 28 errata-xmlrpc 2025-10-23 22:29:13 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7

Via RHSA-2024:8080 https://access.redhat.com/errata/RHSA-2024:8080