GHSA-8G9C-28FC-MCX2: Microsoft.IdentityModel.JsonWebTokens NuGet

Vulnerability summary

GHSA-8G9C-28FC-MCX2 is a medium (CVSS 6.8) vulnerability in Microsoft.IdentityModel.JsonWebTokens NuGet.

Timeline

1. 09-01-2024
   PublishedVulnerability first disclosed.
2. 10-09-2026
   Last modifiedVulnerability information updated.

Description

Duplicate Advisory: Microsoft Identity Denial of service vulnerability ### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-59j7-ghrg-fj52. This link is maintained to preserve external references. ### Original Description ### Impact An attacker could exploit this vulnerability by crafting a malicious JSON Web Encryption (JWE) token with a high compression ratio. This token, when processed by a server, leads to excessive memory allocation and processing time during decompression, causing a denial-of-service (DoS) condition. It's important to note that the attacker must have access to the public encrypt key registered with the IDP(Entra ID) for successful exploitation. _According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?_ A scope change (S:C) in the CVSS metric indicates that successful exploitation of this vulnerability could extend beyond the immediate processing of malicious tokens, affecting the overall availability of the system by causing a denial-of-service (DoS) condition. ### Patches The vulnerability has been fixed. Users should update **all** their Microsoft.IdentityModel versions to 7.1.2 (for 7x) or higher, 6.34.0 (for 6x) or higher, and 5.7.0 (for 5x). ### Workarounds No, users must upgrade. ### References https://aka.ms/IdentityModel/Jan2024/zip

No weakness data has been published for this record.