CVE-2023-52428

Aliases:GHSA-gvpg-vgmx-xg6wCGA-27v6-6h2h-4px2CGA-2pgx-r769-38xpCGA-3275-f768-vfjvCGA-34c9-v523-8j3gCGA-3rj2-9pr6-xh34CGA-4q8m-p3h3-v23cCGA-5gr9-xcgq-749fCGA-796w-jxpj-gcpgCGA-7pcp-pgcf-gcj5CGA-89ph-h874-q2mpCGA-976f-vvrp-8wp5CGA-cggf-wpw4-rqpvCGA-fpcp-wwjj-5823CGA-gr25-xcr7-f9jrCGA-h7c9-vfx9-2783CGA-hhrx-fmm7-22hfCGA-hxqq-x7jg-qfpcCGA-m7pq-w5q6-6h46CGA-mpv7-r7vq-9prhCGA-p398-mmvw-j2ggCGA-p4hc-6w4p-x682CGA-3gj8-gv88-4vwjCGA-3pf4-9h2w-h582CGA-4284-f6wm-9vjqCGA-4ch4-r9rr-jw32CGA-5m8p-7qw4-q9mpCGA-7m8g-9cx2-g4mpCGA-7wv8-mxw2-q67fCGA-8jxj-3c8g-7m54CGA-m2gv-m5f6-5cg4CGA-pvj4-h5p4-xrr2CGA-qw5j-hmp2-grwvCGA-r28h-p3hh-4hgqCGA-r9r4-2c5m-2pxmCGA-vggp-qxrj-rvrmCGA-w5gh-wq8x-56rcCGA-w6h8-xc4j-qphfCGA-wcvw-hg5j-vx7wCGA-wmgw-w925-3v92CGA-wppv-55h6-qqw3
Advisory lineage Upstream: 0 Downstream: 2
Modified
Published: 11 Feb 2024, 00:00
Last modified:30 Oct 2024, 19:50

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
0.81% LOW
1% probability +0.74%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

11 Feb 2024, 00:00
Published
Vulnerability first disclosed
30 Oct 2024, 19:50
Last Modified
Vulnerability information updated

Description

In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.

CVSS Metrics

  • v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.81%• Percentile: 56%

Techniques & Countermeasures

  • CWE-770•Allocation of Resources Without Limits or Throttling

    The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected Systems

  • chainguard•celeborn-0.5

    < 0.5.4-r26

  • chainguard•celeborn-0.6

    < 0.6.3-r7

  • chainguard•dependency-track

    < 4.10.1-r3

  • chainguard•dependency-track-bundled

    < 4.10.1-r3

  • chainguard•druid

    < 34.0.0-r6 | < 37.0.0-r14 | < 37.0.0-r56

  • chainguard•elasticsearch-7

    < 7.17.20-r0

  • chainguard•elasticsearch-7-iamguarded

    < 7.17.20-r0

  • chainguard•hadoop-client-modules

    < 3.3.6-r7

  • chainguard•ranger

    all

  • chainguard•sonarqube-10

    < 25.1.0.102122-r0

  • chainguard•spark-3.5-scala-2.12

    all

  • chainguard•spark-3.5-scala-2.13

    all

  • chainguard•tez

    < 0.10.4-r6

  • chainguard•thingsboard

    < 3.7-r2

  • chainguard•thingsboard-tb-js-executor

    < 3.7-r2

  • chainguard•thingsboard-tb-mqtt-transport

    < 3.7-r2

  • chainguard•thingsboard-tb-node

    < 3.7-r2

  • chainguard•thingsboard-tb-web-ui

    < 3.7-r2

  • wolfi•celeborn-0.6

    < 0.6.3-r7

  • wolfi•dependency-track

    < 4.10.1-r3

  • wolfi•dependency-track-bundled

    < 4.10.1-r3

  • wolfi•druid

    < 34.0.0-r6 | < 37.0.0-r14 | < 37.0.0-r56

  • wolfi•sonarqube-10

    < 25.1.0.102122-r0

  • wolfi•tez

    < 0.10.4-r6

  • wolfi•thingsboard

    < 3.7-r2

  • wolfi•thingsboard-tb-js-executor

    < 3.7-r2

  • wolfi•thingsboard-tb-mqtt-transport

    < 3.7-r2

  • wolfi•thingsboard-tb-node

    < 3.7-r2

  • wolfi•thingsboard-tb-web-ui

    < 3.7-r2

  • connect2id•nimbus_jose\+jwt

    < 9.37.2

  • com.nimbusds•nimbus-jose-jwt

    < 9.37.2

References (7)