Skip to content
OpenAdvisories

Package · Debian

cjose

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical 9.1
    CVE-2026-53939

    OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption

    OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm (`A128CBC-HS256`, `A192CBC-HS384`, or `A256CBC-HS512…

    OpenIDC cjose cjose cjose Debian Ubuntu
  • High 8.2
    CVE-2026-53938

    OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW)

    OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms (`alg` = `A128KW`, `A192KW`, `A256KW`) does not validate the le…

    OpenIDC cjose cjose cjose Debian Ubuntu
  • High 8.6
    CVE-2023-37464

    Incorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjose

    OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octet…

    OpenIDC cjose cjose cjose Debian Ubuntu Alpine