CVE-2023-52428: Denial of Service in Connect2id Nimbus JOSE+JWT

February 11, 2024 (updated October 30, 2024)

In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.

References

bitbucket.org/connect2id/nimbus-jose-jwt
bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e
bitbucket.org/connect2id/nimbus-jose-jwt/issues/526
connect2id.com/products/nimbus-jose-jwt
github.com/advisories/GHSA-gvpg-vgmx-xg6w
nvd.nist.gov/vuln/detail/CVE-2023-52428

Code Behaviors & Features

Detect and mitigate CVE-2023-52428 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →