{"answers":{"affected":"20 open source packages ship an affected version, including jose, jose-browser-runtime and jose-node-cjs-runtime. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-36083 exists.","fix":"Upgrade jose to a fixed version for your release line: 1.28.2, 2.0.6, 3.20.4 or 4.9.2.","what":"CVE-2022-36083 is a medium-severity denial of service vulnerability in panva jose, published on 7 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-36083 and fix it if it is affected.\n\nWhat it is: CVE-2022-36083 is a medium-severity denial of service vulnerability in panva jose, published on 7 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-36083 exists.\n\nAffected packages and fixed versions:\n- jose (npm): affected from 1.0.0; fixed in 1.28.2\n- jose (npm): affected from 1.0.0; fixed in 1.28.2\n- jose (npm): affected from 2.0.0; fixed in 2.0.6\n- jose (npm): affected from 2.0.0; fixed in 2.0.6\n- jose (npm): affected from 3.0.0; fixed in 3.20.4\n- jose (npm): affected from 3.0.0; fixed in 3.20.4\n- jose (npm): affected from 4.0.0; fixed in 4.9.2\n- jose (npm): affected from 4.0.0; fixed in 4.9.2\n- jose-browser-runtime (npm): affected from 3.0.0; fixed in 3.20.4\n- jose-browser-runtime (npm): affected from 3.0.0; fixed in 3.20.4\n- jose-browser-runtime (npm): affected from 4.0.0; fixed in 4.9.2\n- jose-browser-runtime (npm): affected from 4.0.0; fixed in 4.9.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-36083/ (Markdown: https://insights.sbomify.com/CVE-2022-36083/index.md)","id":"CVE-2022-36083","markdown":"https://insights.sbomify.com/CVE-2022-36083/index.md","name":"CVE-2022-36083","record":{"aliases":["DEBIAN-CVE-2022-36083","GHSA-jv3g-j58f-9mq9","UBUNTU-CVE-2022-36083"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"JOSE JavaScript library","requires_auth":"none","summary":"Attackers can cause CPU exhaustion in applications using the JOSE library by sending crafted JWEs with high PBKDF2 counts, leading to denial of service.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"jose","vendor":"panva"}],"cvss":{"score":5.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"cwes":[{"id":"CWE-834","name":"Excessive Iteration"},{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"description":"JOSE is \"JSON Web Almost Everything\" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named `p2c` PBES2 Count, which determines how many PBKDF2 iterations must be executed in order to derive a CEK wrapping key. The purpose of this parameter is to intentionally slow down the key derivation function in order to make password brute-force and dictionary attacks more expensive. This makes the PBES2 algorithms unsuitable for situations where the JWE is coming from an untrusted source: an adversary can intentionally pick an extremely high PBES2 Count value, that will initiate a CPU-bound computation that may take an unreasonable amount of time to finish. Under certain conditions, it is possible to have the user's environment consume unreasonable amount of CPU time. The impact is limited only to users utilizing the JWE decryption APIs with symmetric secrets to decrypt JWEs from untrusted parties who do not limit the accepted JWE Key Management Algorithms (`alg` Header Parameter) using the `keyManagementAlgorithms` (or `algorithms` in v1.x) decryption option or through other means. The `v1.28.2`, `v2.0.6`, `v3.20.4`, and `v4.9.2` releases limit the maximum PBKDF2 iteration count to `10000` by default. It is possible to adjust this limit with a newly introduced `maxPBES2Count` decryption option. If users are unable to upgrade their required library version, they have two options depending on whether they expect to receive JWEs using any of the three PBKDF2-based JWE key management algorithms. They can use the `keyManagementAlgorithms` decryption option to disable accepting PBKDF2 altogether, or they can inspect the JOSE Header prior to using the decryption API and limit the PBKDF2 iteration count (`p2c` Header Parameter).","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"JOSE vulnerable to resource exhaustion via specifically crafted JWE","id":"CVE-2022-36083","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"denial_of_service","year":"2022"},"n_packages":20,"n_references":3,"next":{"headline":"cruddl vulnerable to AQL injection through flexSearch","id":"CVE-2022-36084"},"packages":[{"ecosystem":"npm","fixed":["1.28.2"],"introduced":["1.0.0"],"last_affected":[],"package":"jose","purl":null,"source":"GHSA-jv3g-j58f-9mq9"},{"ecosystem":"npm","fixed":["1.28.2"],"introduced":["1.0.0"],"last_affected":[],"package":"jose","purl":"pkg:npm/jose","source":"GHSA-jv3g-j58f-9mq9"},{"ecosystem":"npm","fixed":["2.0.6"],"introduced":["2.0.0"],"last_affected":[],"package":"jose","purl":null,"source":"GHSA-jv3g-j58f-9mq9"},{"ecosystem":"npm","fixed":["2.0.6"],"introduced":["2.0.0"],"last_affected":[],"package":"jose","purl":"pkg:npm/jose","source":"GHSA-jv3g-j58f-9mq9"},{"ecosystem":"npm","fixed":["3.20.4"],"introduced":["3.0.0"],"last_affected":[],"package":"jose","purl":null,"source":"GHSA-jv3g-j58f-9mq9"},{"ecosystem":"npm","fixed":["3.20.4"],"introduced":["3.0.0"],"last_affected":[],"package":"jose","purl":"pkg:npm/jose","source":"GHSA-jv3g-j58f-9mq9"},{"ecosystem":"npm","fixed":["4.9.2"],"introduced":["4.0.0"],"last_affected":[],"package":"jose","purl":null,"source":"GHSA-jv3g-j58f-9mq9"},{"ecosystem":"npm","fixed":["4.9.2"],"introduced":["4.0.0"],"last_affected":[],"package":"jose","purl":"pkg:npm/jose","source":"GHSA-jv3g-j58f-9mq9"},{"ecosystem":"npm","fixed":["3.20.4"],"introduced":["3.0.0"],"last_affected":[],"package":"jose-browser-runtime","purl":null,"source":"GHSA-jv3g-j58f-9mq9"},{"ecosystem":"npm","fixed":["3.20.4"],"introduced":["3.0.0"],"last_affected":[],"package":"jose-browser-runtime","purl":"pkg:npm/jose-browser-runtime","source":"GHSA-jv3g-j58f-9mq9"},{"ecosystem":"npm","fixed":["4.9.2"],"introduced":["4.0.0"],"last_affected":[],"package":"jose-browser-runtime","purl":null,"source":"GHSA-jv3g-j58f-9mq9"},{"ecosystem":"npm","fixed":["4.9.2"],"introduced":["4.0.0"],"last_affected":[],"package":"jose-browser-runtime","purl":"pkg:npm/jose-browser-runtime","source":"GHSA-jv3g-j58f-9mq9"},{"ecosystem":"npm","fixed":["3.20.4"],"introduced":["3.0.0"],"last_affected":[],"package":"jose-node-cjs-runtime","purl":null,"source":"GHSA-jv3g-j58f-9mq9"},{"ecosystem":"npm","fixed":["3.20.4"],"introduced":["3.0.0"],"last_affected":[],"package":"jose-node-cjs-runtime","purl":"pkg:npm/jose-node-cjs-runtime","source":"GHSA-jv3g-j58f-9mq9"},{"ecosystem":"npm","fixed":["4.9.2"],"introduced":["4.0.0"],"last_affected":[],"package":"jose-node-cjs-runtime","purl":null,"source":"GHSA-jv3g-j58f-9mq9"},{"ecosystem":"npm","fixed":["4.9.2"],"introduced":["4.0.0"],"last_affected":[],"package":"jose-node-cjs-runtime","purl":"pkg:npm/jose-node-cjs-runtime","source":"GHSA-jv3g-j58f-9mq9"},{"ecosystem":"npm","fixed":["3.20.4"],"introduced":["3.0.0"],"last_affected":[],"package":"jose-node-esm-runtime","purl":null,"source":"GHSA-jv3g-j58f-9mq9"},{"ecosystem":"npm","fixed":["3.20.4"],"introduced":["3.0.0"],"last_affected":[],"package":"jose-node-esm-runtime","purl":"pkg:npm/jose-node-esm-runtime","source":"GHSA-jv3g-j58f-9mq9"},{"ecosystem":"npm","fixed":["4.9.2"],"introduced":["4.0.0"],"last_affected":[],"package":"jose-node-esm-runtime","purl":null,"source":"GHSA-jv3g-j58f-9mq9"},{"ecosystem":"npm","fixed":["4.9.2"],"introduced":["4.0.0"],"last_affected":[],"package":"jose-node-esm-runtime","purl":"pkg:npm/jose-node-esm-runtime","source":"GHSA-jv3g-j58f-9mq9"}],"prev":{"headline":"mangadex-downloader vulnerable to unauthorized file reading","id":"CVE-2022-36082"},"products":["jose"],"published":"2022-09-07","related":[{"cvss_score":5.9,"headline":"Padding Oracle Attack due to Observable Timing Discrepancy in jose","id":"CVE-2021-29443","kev_date_added":null,"published":"2021-04-16"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-04-22","vendors":["panva"]},"summary":"Attackers can cause CPU exhaustion in applications using the JOSE library by sending crafted JWEs with high PBKDF2 counts, leading to denial of service.","url":"https://insights.sbomify.com/CVE-2022-36083/"}