Denial Of Service (DoS)

2024-03-0807:28:34

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

denial of service

vulnerability

flaw

plaintext

decryption

jwe token

application-level mechanism

resource exhaustion

4.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.2%

JSON

jose is vulnerable to Denial Of Service (DoS). This vulnerability is due to a flaw in the support for decompressing plaintext post-decryption. An attacker can exploit a scenario with exceptionally high compression ratios, leading to JWE token lengths falling below application-defined limits. This could render existing application-level mechanisms ineffective against resource exhaustion.

CPENameOperatorVersion
josele2.0.6
josele4.15.4
jose-node-cjs-runtimele4.15.4
jose-node-esm-runtimele4.15.4
josele2.0.6
josele4.15.4
jose-node-cjs-runtimele4.15.4
jose-node-esm-runtimele4.15.4

Name	Operator	Version
jose	le	2.0.6
jose	le	4.15.4
jose-node-cjs-runtime	le	4.15.4
jose-node-esm-runtime	le	4.15.4
jose	le	2.0.6
jose	le	4.15.4
jose-node-cjs-runtime	le	4.15.4
jose-node-esm-runtime	le	4.15.4