operatorfabric-core icon indicating copy to clipboard operation
operatorfabric-core copied to clipboard

Published 20 hours ago • verified publisher icon opfab

CVE-2023-52428 (High) detected in nimbus-jose-jwt-9.24.4.jar

Open mend-bolt-for-github[bot] opened this issue 1 year ago • 1 comments

CVE-2023-52428 - High Severity Vulnerability

Vulnerable Library - nimbus-jose-jwt-9.24.4.jar

Java library for Javascript Object Signing and Encryption (JOSE) and JSON Web Tokens (JWT)

Library home page: https://bitbucket.org/connect2id/nimbus-jose-jwt

Path to dependency file: /tools/spring/spring-test-utilities/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.nimbusds/nimbus-jose-jwt/9.24.4/29a1f6a00a4daa3e1873f6bf4f16ddf4d6fd6d37/nimbus-jose-jwt-9.24.4.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.nimbusds/nimbus-jose-jwt/9.24.4/29a1f6a00a4daa3e1873f6bf4f16ddf4d6fd6d37/nimbus-jose-jwt-9.24.4.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.nimbusds/nimbus-jose-jwt/9.24.4/29a1f6a00a4daa3e1873f6bf4f16ddf4d6fd6d37/nimbus-jose-jwt-9.24.4.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.nimbusds/nimbus-jose-jwt/9.24.4/29a1f6a00a4daa3e1873f6bf4f16ddf4d6fd6d37/nimbus-jose-jwt-9.24.4.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.nimbusds/nimbus-jose-jwt/9.24.4/29a1f6a00a4daa3e1873f6bf4f16ddf4d6fd6d37/nimbus-jose-jwt-9.24.4.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.nimbusds/nimbus-jose-jwt/9.24.4/29a1f6a00a4daa3e1873f6bf4f16ddf4d6fd6d37/nimbus-jose-jwt-9.24.4.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.nimbusds/nimbus-jose-jwt/9.24.4/29a1f6a00a4daa3e1873f6bf4f16ddf4d6fd6d37/nimbus-jose-jwt-9.24.4.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.nimbusds/nimbus-jose-jwt/9.24.4/29a1f6a00a4daa3e1873f6bf4f16ddf4d6fd6d37/nimbus-jose-jwt-9.24.4.jar

Dependency Hierarchy:

  • spring-security-oauth2-jose-6.2.4.jar (Root Library)
    • :x: nimbus-jose-jwt-9.24.4.jar (Vulnerable Library)

Found in HEAD commit: f878d4e3700978ab3ede9696d0fb223004862e20

Found in base branch: develop

Vulnerability Details

In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.

Publish Date: 2024-02-11

URL: CVE-2023-52428

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High
For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-52428

Release Date: 2024-02-11

Fix Resolution: com.nimbusds:nimbus-jose-jwt:9.37.2

Step up your Open Source Security Game with Mend here

mend-bolt-for-github[bot] avatar Mar 18 '24 08:03 mend-bolt-for-github[bot]

Need security spring-security-oauth2-jose update

freddidierRTE avatar Mar 20 '24 12:03 freddidierRTE

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

mend-bolt-for-github[bot] avatar Jun 17 '24 07:06 mend-bolt-for-github[bot]