{"answers":{"affected":"2 open source packages ship an affected version, including org.bitbucket.b_c:jose4j.","exploited":"There is no known exploitation of GHSA-jgvc-jfgh-rjvv in the wild and no public exploit code.","fix":"Upgrade org.bitbucket.b_c:jose4j to 0.9.3 or later.","what":"GHSA-jgvc-jfgh-rjvv is a vulnerability in org.bitbucket.b_c:jose4j, published on 27 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-jgvc-jfgh-rjvv and fix it if it is affected.\n\nWhat it is: GHSA-jgvc-jfgh-rjvv is a vulnerability in org.bitbucket.b_c:jose4j, published on 27 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-jgvc-jfgh-rjvv in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- org.bitbucket.b_c:jose4j (Maven): affected all versions; fixed in 0.9.3\n- org.bitbucket.b_c:jose4j (Maven): affected all versions; fixed in 0.9.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-jgvc-jfgh-rjvv/ (Markdown: https://insights.sbomify.com/GHSA-jgvc-jfgh-rjvv/index.md)","id":"GHSA-jgvc-jfgh-rjvv","markdown":"https://insights.sbomify.com/GHSA-jgvc-jfgh-rjvv/index.md","name":"GHSA-jgvc-jfgh-rjvv","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Java JOSE library","requires_auth":"none","summary":"A chosen ciphertext attack in jose4j allows attackers to decrypt RSA1_5 or RSA_OAEP encrypted data and potentially forge signatures.","user_interaction":"not_required","vuln_class":"weak_cryptography"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\nRSA1_5 in jose4j is susceptible to chosen ciphertext attacks. The\nattack allows to decrypt RSA1_5 or RSA_OAEP encrypted ciphertexts. It may\nbe feasible to sign with affected keys.\n\n### Severity\nModerate - exploiting this ciphertext attack could result in the ability to decrypt RSA1_5 or RSA_OAEP encrypted ciphertexts.\n\n### Proof of Concept\nA test case that can reproduce the padding oracle uses the following private key:\n\n```\n{\n        \"kty\": \"RSA\",\n        \"alg\": \"RSA1_5\",\n        \"use\": \"enc\",\n        \"n\": \"w2A4cbwOAK4ATnwXkGWereqv9dkEcgAGHc9g-cjo1HFeilYirvfD2Un2vQxW_6g2OKRPmmo46vMZFMYv_V57174j411y-NQlZGb7iFqMQADzo60VZ7vpvAX_NuxNGxYR-N2cBgvgqDiGAoO9ouNdhuHhxipTjGVfrPUpxmJtNPZpxsgxQWSpYCYMl304DD_5wWrnumNNIKOaVsAYmjFPV_wqxFCHbitPd1BG9SwXPk7wAHtXT6rYaUImS_OKaHkTO1OO0PNhd3-wJRNMCh_EGUwAghfWgFyAd20pQLZamamxgHvfL4-0hwuzndhHt0ye-gRVTtXDFEwABB--zwvlCw\",\n        \"e\": \"AQAB\",\n        \"kid\": \"rsa1_5\",\n        \"d\": \"EjMvbuDeyQ9sdeM3arscqgTXuWYq9Netui8sUHh3v_qDnQ1jE7t-4gny0y-IFy67RlGAHNlSTgixSG8h309i5_kNbMuyvx08EntJaS1OLVQpXhDskoo9vscsPBiNIj3PFMjIFQQcPG9vhGJzUu4tMzhtiME-oTB8VidMae-XTryPvozTu4rgfb4U7uauvLqESLz3A5xtzPnwNwqXAIlrdxU-MT_iln08on_QIF8afWUqCbsWWjEck_QDKLVpzh8VV9kkEVWwYfCFhHBwS-fgGJJTE3gK4HwOokydMtH95Dzj47MA2pLe600l7ioyGSPltcv967NtOpxMPM5ro751KQ\",\n        \"p\": \"-F1u3NAMWPu1TIuvIywIjh5fuiA3AVKLgS6Fw_hAi3M9c3T7E1zNJZuHgQExJEu06ZPfzye9m7taDzh-Vw4VGDED_MZedsE2jEsWa9EKeq3bZVf5j81FLCHH8BicFqrPjvoVUC35wrl9SGJzaOa7KXxD2jW22umYjJS_kcopvf0\",\n        \"q\": \"yWHG7jHqvfqT8gfhIlxpMbeJ02FrWIkgJC-zOJ26wXC6oxPeqhqEO7ulGqZPngNDdSGgWcQ7noGEU8O4MA9V3yhl91TFZy8unox0sGe0jDMwtxm3saXtTsjTE7FBxzcR0PubfyGiS0fJqQcj8oJSWzZPkUshzZ8rF3jTLc8UWac\",\n        \"dp\": \"Va9WWhPkzqY4TCo8x_OfF_jeqcYHdAtYWb8FIzD4g6PEZZrMLEft9rWLsDQLEiyUQ6lio4NgZOPkFDA3Vi1jla8DYyfE20-ZVBlrqNK7vMtST8pkLPpyjOEyq2CyKRfQ99DLnZfe_RElad2dV2mS1KMsfZHeffPtT0LaPJ_0erk\",\n        \"dq\": \"M8rA1cviun9yg0HBhgvMRiwU91dLu1Zw_L2D02DFgjCS35QhpQ_yyEYHPWZefZ4LQFmoms2cI7TdqolgmoOnKyCBsO2NY29AByjKbgAN8CzOL5kepEKvWJ7PonXpG-ou29eJ81VcHw5Ub_NVLG6V7b13E0AGbpKsC3pYnaRvcGs\",\n        \"qi\": \"8zIqISvddJYC93hP0sKkdHuVd-Mes_gsbi8xqSFYGqc-wSU12KjzHnZmBuJl_VTGy9CO9W4K2gejr588a3Ozf9U5hx9qCVkV0_ttxHcTRem5sFPe9z-HkQE5IMW3SdmL1sEcvkzD7z8QhcHRpp5aMptfuwnxBPY8U449_iNgXd4\"\n      },\n```\njose4j has distinguishable behvaior for the following test cases:\n\nThe first ciphertext below contains an invalid PKCS #1 padding.  Because of hte invalid padding a random AES key is generated during decryption.  This leads to an authentication error.\n\n```\n\"eyJhbGciOiJSU0ExXzUiLCJlbmMiOiJBMTI4R0NNIn0.ksmeZ6dBbP0UfDEaLXlqPl2XDaAA29kGlKtDb89x-4xN5-A6bx2umI_ToHK2GadzxUOgKROCACYb6rmKsqsQCOZaBsnq_4mDII1W0pja7Lz4zTnr7R3O4kALg4zXqG-gSlcDA7k1NgkpMDS15PjMmADqyqxbxQsXdfjstN324iqdvYGh6NsckkfTSWxDVAqiSR9fW8PsIbo3uSMokNaC-f64CDWIB9AsCxhF-3mnFbxXNxw7JE0upOgG4enQ8kZkwi_v54HBqAau1YNW7gPhFV8ElTQ71J6aHB3dja23lbWdaJmrK6PJE7gEeZmUbFkSYmuyzRUS-NGfXA23fYv5JQ.46AsIpPgnJCLH0Xm.u2rG.LyEHEGCWM8CXDEEHiaqhiQ\"\n```\n\nThe second ciphertext below ontains valid PKCS #1 padding, but the size of the encoded key is incorrect.  Because of this, trying to dcrypt the symmetric part of the ciphertext immediately fails with org.jose4j.lang.JoseException: Invalid key for AES/GCM/NoPadding.\n\n```\n\"eyJhbGciOiJSU0ExXzUiLCJlbmMiOiJBMTI4R0NNIn0.oyVTmkyoChxFtyCtiKhv8OpBJcV6C6s_gMFSSRJBNStpdHPzq2YmroTfXGj1J1plFG4BBQwIZtdt6rIS6YkCvTLGqP1hds9CAO1a_bgRyoAVuOVvH2vmz5U2r74_SRbAzD35M7yZ_tSnnEdMFlHMFbf5uNwmgArrtPgh0V5OLn5i4XIc154FLTiQlvAEhUxiPuYBkm_1GBiYEH4JjP2RKXAUx_TxAVwPsOfIPAVrO0Ev_nvdtVLCE-uOn8WQbxh4wwOztaXOV1HIaPrl7HN-YtDOA840QUHm97ZZLAPRgLzGlkMI0ZS8QkYdb9_FT3KMbNu60nBKEniv2uhBdIhM9g.46AsIpPgnJCLH0Xm.u2rG.LyEHEGCWM8CXDEEHiaqhiQ\"\n```\n\nA correct implementation would not have distinguishable behavior.  A test case for the missing algorithm checks uses the key:\n\n```\n{\n        \"alg\": \"RSA-OAEP\",\n        \"use\": \"enc\",\n        \"n\": \"kqGboBfAWttWPCA-0cGRgsY6SaYoIARt0B_PkaEcIq9HPYNdu9n6UuWHuuTHrjF_ZoQW97r5HaAorNvrMEGTGdxCHZdEtkHvNVVmrtxTBLiQCbCozXhFoIrVcr3qUBrdGnNn_M3jJi7Wg7p_-x62nS5gNG875oyheRkutHsQXikFZwsN3q_TsPNOVlCiHy8mxzaFTUQGm-X8UYexFyAivlDSjgDJLAZSWfxd7k9Gxuwa3AUfQqQcVcegmgKGCaErQ3qQbh1x7WB6iopE3_-GZ8HMAVtR9AmrVscqYsnjhaCehfAI0iKKs8zXr8tISc0ORbaalrkk03H1ZrsEnDKEWQ\",\n        \"e\": \"AQAB\",\n        \"d\": \"YsfIRYN6rDqSz5KRf1E9q7HK1o6-_UK-j7S-asb0Y1FdVs1GuiRQhMPoOjmhY3Io93EI3_7vj8uzWzAUMsAaTxOY3sJnIbktYuqTcD0xGD8VmdGPBkx963db8B6M2UYfqZARf7dbzP9EuB1N1miMcTsqyGgfHGOk7CXQ1vkIv8Uww38KMtEdJ3iB8r-f3qcu-UJjE7Egw9CxKOMjArOXxZEr4VnoIXrImrcTxBfjdY8GbzXGATiPQLur5GT99ZDW78falsir-b5Ean6HNyOeuaJuceT-yjgCXn57Rd3oIHD94CrjNtjBusoLdjbr489L8K9ksCh1gynzLGkeeWgVGQ\",\n        \"p\": \"0xalbl1PJbSBGD4XOjIYJLwMYyHMiM06SBauMGzBfCask5DN5jH68Kw1yPS4wkLpx4ltGLuy0X5mMaZzrSOkBGb27-NizBgB2-L279XotznWeh2jbF05Kqzkoz3VaX_7dRhCHEhOopMQh619hA1bwaJyW1k8aNlLPTl3BotkP4M\",\n        \"q\": \"sdQsQVz3tI7hmisAgiIjppOssEnZaZO0ONeRRDxBHGLe3BCo1FJoMMQryOAlglayjQnnWjQ-BpwUpa0r9YQhVLweoNEIig6Beph7iYRZgOHEiiTTgUIGgXAL6xhsby1PueUfT0xsN1Y7qt5f5EwOfu7tnFqNyJXIp9W1NQgU6fM\",\n        \"dp\": \"kEpEnuJNfdqa-_VFb1RayJF6bjDmXQTcN_a47wUIZVMSWHR9KkMz41v0D_-oY7HVl73Kw0NagnVCaeH75HgeX5v6ZBQsrpIigynr3hl8T_LLNwIXebVnpFI2n5de0BTZ0DraxfZvOhYJEJV43NE8zWm7fdHLx2fxVFJ5mBGkXv0\",\n        \"dq\": \"U_xJCnXF51iz5AP7MXq-K6YDIR8_t0UzEMV-riNm_OkVKAoWMnDZFG8R3sU98djQaxwKT-fsg2KjvbuTz1igBUzzijAvQESpkiUB82i2fNAj6rqJybpNKESq3FWkoL1dsgYsS19knJ31gDWWRFRHZFujjPyXiexz4BBmjK1Mc1E\",\n        \"qi\": \"Uvb84tWiJF3fB-U9wZSPi7juGgrzeXS_LYtf5fcdV0fZg_h_5nSVpXyYyQ-PK218qEC5MlDkaHKRD9wBOe_eU_zJTNoXzB2oAcgl2MapBWUMytbiF84ghP_2K9UD63ZVsyrorSZhmsJIBBuqQjrmk0tIdpMdlMxLYhrbYwFxUqc\",\n        \"kid\": \"kid-rsa-enc-oaep\",\n        \"kty\": \"RSA\"\n      }\n```\n\nand the cipher text\n\n```\n\"eyJhbGciOiJSU0ExXzUiLCJlbmMiOiJBMTI4R0NNIn0.CuUuY9PH2wWjuLXd5O9LLFanwyt5-y-NzEpy9rC3A63tFsvdp8GWP1kRt1d3zd0bGqakwls623VQxzxqQ25j5gdHh8dKMl67xTLHt1Qlg36nI9Ukn7syq25VrzfrRRwy0k7isqMncHpzuBQlmfzPrszW7d13z7_ex0Uha869RaP-W2NNBfHYw26xIXcCSVIPg8jTLA7h6QmOetEej-NXXcWrRKQgBRapYy4iWrij9Vr3JzAGSHVtIID74tFOm01FdJj4s1M4IXegDbvAdQb6Vao1Ln5GolnTki4IGvH5FDssDHz6MS2JG5QBcITzfuXU81vDC00xzNEuMat0AngmOw.UjPQbnakkZYUdoDa.vcbS.WQ_bOPiGKjPSq-qyGOIfjA\"\n```\nThe header of this ciphertext is:\n  ``` {\"alg\":\"RSA1_5\",\"enc\":\"A128GCM\"}```\nHence the algorithm in the header does not match the algorithm in the key. Such ciphertexts should be rejected. The wrapped key is a valid RSA1_5 encrypted key. jose4j currently decrypts the ciphertext above without an exception. The problem with this behavior is that jose4j also allows chosen ciphertext attacks when the key uses RSA_OAEP. The attacker simply has to modify the header to and replace the algorithm with RSA1_5. Attempts to decrypt modified ciphertexts will then leak whether the decrypted message has valid PKCS #1 padding.\n\n### Further Analysis\nFix Commit - https://bitbucket.org/b_c/jose4j/commits/63b86581e7bfcc2d9d04ee15caea4b5bfb911f59\n\n### Timeline\n**Date reported**: 01/27/2023\n**Date fixed**: 02/09/2023\n**Date disclosed**: 04/27/2023","ecosystems":["Maven"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Chosen Ciphertext Attack in Jose4j","id":"GHSA-jgvc-jfgh-rjvv","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Maven","product":null,"products":[],"type":"weak_cryptography","year":"2023"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"Maven","fixed":["0.9.3"],"introduced":["0"],"last_affected":[],"package":"org.bitbucket.b_c:jose4j","purl":null,"source":"GHSA-jgvc-jfgh-rjvv"},{"ecosystem":"Maven","fixed":["0.9.3"],"introduced":["0"],"last_affected":[],"package":"org.bitbucket.b_c:jose4j","purl":"pkg:maven/org.bitbucket.b_c/jose4j","source":"GHSA-jgvc-jfgh-rjvv"}],"products":null,"published":"2023-04-27","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"A chosen ciphertext attack in jose4j allows attackers to decrypt RSA1_5 or RSA_OAEP encrypted data and potentially forge signatures.","url":"https://insights.sbomify.com/GHSA-jgvc-jfgh-rjvv/"}