GHSA-2c7c-3mj9-8fqh: Decryption of malicious PBES2 JWE objects can consume unbounded system resources

November 21, 2023 (updated May 20, 2024)

The go-jose package is subject to a “billion hashes attack” causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-service.

References

github.com/advisories/GHSA-2c7c-3mj9-8fqh
github.com/go-jose/go-jose
github.com/go-jose/go-jose/commit/65351c27657d58960c2e6c9fbb2b00f818e50568
github.com/go-jose/go-jose/commit/a3d307244c3bc50b25a71aa0688764c32ec419c7
github.com/go-jose/go-jose/issues/64

Code Behaviors & Features

Detect and mitigate GHSA-2c7c-3mj9-8fqh with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →