CVE-2021-29445 Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtime
An attacker can decrypt data without the key by exploiting a timing side-channel in the AES-CBC-HMAC decryption process of this Node.js library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-29445?
CVE-2021-29445 is a medium-severity vulnerability in panva jose-node-esm-runtime, published on 16 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. But a possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). A patch was released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `>=3.11.4`. Users should upgrade to `^3.11.4`.
Weakness: CWE-203
Which versions are affected by CVE-2021-29445?
2 open source packages ship an affected version, including jose-node-esm-runtime. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
jose-node-esm-runtime npm | All versions | 3.11.4 |
jose-node-esm-runtime npm | All versions | 3.11.4 |
Products include Jose-Node-Cjs-Runtime Project Jose-Node-Cjs-Runtime.
How do I fix CVE-2021-29445?
Upgrade jose-node-esm-runtime to 3.11.4 or later.
Is CVE-2021-29445 being exploited?
There is no known exploitation of CVE-2021-29445 in the wild and no public exploit code.
Other vulnerabilities in panva jose-node-esm-runtime
Sources
Also known as GHSA-4v4g-726h-xvfv.