Denial of service via decryption of malicious PBES2 JWE objects in github.com/go-jose/go-jose/v3
Overview
Source
ID
GO-2023-2334
Aliases
GHSA-2c7c-3mj9-8fqh
Affected package
Description
The go-jose package is subject to a "billion hashes attack" causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-service.
Summary
1.99k
Total packages affected
help_outline
Packages with at least one version that is affected by the advisory or has an affected dependency.
849
Packages with a known fix
help_outline
Packages with versions affected by the advisory that have a greater version that is not affected.
0.15%
Total ecosystem affected
help_outline
The proportion of packages in the ecosystem that are affected by the advisory (fixed or not).
Affected Version: Introduced: 0, Fixed: 3.0.1
Affected Version: Introduced: 0
Affected