CVE-2023-50658 jose2go vulnerable to denial of service via large p2c value
Attackers can cause denial of service via CPU exhaustion in the jose2go Go library by supplying a large PBES2 count value.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-50658?
CVE-2023-50658 is a high-severity denial of service vulnerability in n/a, published on 25 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
Weakness: CWE-770
Which versions are affected by CVE-2023-50658?
5 open source packages ship an affected version, including github.com/dvsekhvalnov/jose2go. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/dvsekhvalnov/jose2go Go | All versions | 1.5.1-0.20231206184617-48ba0b76bc88 |
github.com/dvsekhvalnov/jose2go Go | All versions | 1.5.1-0.20231206184617-48ba0b76bc88 |
github.com/dvsekhvalnov/jose2go Go | All versions | 1.5.1-0.20231206184617-48ba0b76bc88 |
github.com/dvsekhvalnov/jose2go Go | All versions | 1.6.0 |
github.com/dvsekhvalnov/jose2go Go | All versions | 1.6.0 |
Products include Dvsekhvalnov Jose2go.
How do I fix CVE-2023-50658?
Upgrade github.com/dvsekhvalnov/jose2go to a fixed version for your release line: 1.5.1-0.20231206184617-48ba0b76bc88 or 1.6.0.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-50658 being exploited?
There is no known exploitation of CVE-2023-50658 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as AZL-35422, AZL-35426, DEBIAN-CVE-2023-50658, GHSA-6294-6rgp-fr7r, GHSA-mhpq-9638-x6pw, GO-2023-2409 and 1 more.