View all vulnerabilities

CVE-2023-51775

jose4j denial of service via specifically crafted JWE

Description

The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
Patch Available

Fix available through Seal Security. No upgrade required, protect your application instantly.

Fix without upgrading
Vulnerability Details
Score
6.4
Score Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Versions
org.bitbucket.b_c:jose4j < 0.9.4
Severity
Medium
Medium
Medium
Ecosystem
Java
Publish Date
February 28, 2024
Modified Date
October 22, 2024