CVE-2023-50658: jose2go vulnerable to denial of service via large p2c value
(updated )
The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
References
- github.com/advisories/GHSA-6294-6rgp-fr7r
- github.com/dvsekhvalnov/jose2go
- github.com/dvsekhvalnov/jose2go/commit/a4584e9dd7128608fedbc67892eba9697f0d5317
- github.com/dvsekhvalnov/jose2go/compare/v1.5.0...v1.6.0
- github.com/dvsekhvalnov/jose2go/issues/31
- nvd.nist.gov/vuln/detail/CVE-2023-50658
- pkg.go.dev/vuln/GO-2023-2409
- www.blackhat.com/us-23/briefings/schedule/
Code Behaviors & Features
Detect and mitigate CVE-2023-50658 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →