Skip to content
OpenAdvisories
High ELSA-2023-4411 1 CVE

Important: cjose security update (Oracle Linux 9)

Published Aug 2, 2023 · Updated Aug 2, 2023

Ecosystem: Oracle Linux

Summary

[0.6.1-13]
- CVE-2023-37464 cjose: AES GCM decryption uses the Tag length from the actual
Authentication Tag provided in the JWE
Resolves: rhbz#2223308

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 9 cjose 0:0.6.1-13.el9_2

Vulnerabilities 1

  • High 8.6
    CVE-2023-37464

    Incorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjose

    OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octet…

    OpenIDC cjose cjose cjose Debian Ubuntu Azure Linux Alpine