Summary
cjose
[0.6.1-3]
- CVE-2023-37464 cjose: AES GCM decryption uses the Tag length from the actual
Authentication Tag provided in the JWE
Resolves: rhbz#2223308
mod_auth_openidc
[2.4.9.4-1]
- Resolves: rhbz#2025368 - Rebase to new version
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | cjose | 0:0.6.1-3.module+el8.8.0+21137+b6cedbc2 |
| Oracle Linux · 8 | cjose-devel | 0:0.6.1-3.module+el8.8.0+21137+b6cedbc2 |
| Oracle Linux · 8 | mod_auth_openidc | 0:2.4.9.4-1.module+el8.7.0+20769+fca4d9d0 |
Vulnerabilities 1
-
High 8.6
Incorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjose
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octet…