org.bitbucket.b_c:jose4j

4 results · Feed

• High 7.5
  CVE-2024-29371

  jose4j is vulnerable to DoS via compressed JWE content

  In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memor…

  strimzi-kafka-operator-kafka-thirdparty-libs-cc strimzi-kafka-operator-tracing-agent strimzi-kafka-operator-kafka-agent strimzi-kafka-operator-kafka-init Debian Ubuntu Wolfi Maven
  Dec 17, 2025
• Medium 6.5
  CVE-2023-51775

  jose4j denial of service via specifically crafted JWE

  The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

  confluent-kafka confluent-common-docker org.bitbucket.b_c:jose4j libjose4j-java Debian Ubuntu Wolfi Maven
  Dec 25, 2023
• High 7.5
  CVE-2023-31582

  jose4j uses weak cryptographic algorithm

  jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.

  org.bitbucket.b_c:jose4j libjose4j-java libjose4j-java Debian Ubuntu Maven
  Oct 24, 2023
• Medium —
  GHSA-jgvc-jfgh-rjvv

  Chosen Ciphertext Attack in Jose4j

  ### Summary RSA1_5 in jose4j is susceptible to chosen ciphertext attacks. The attack allows to decrypt RSA1_5 or RSA_OAEP encrypted ciphertexts. It may be feasible to sign with affected keys. ### Severity Moderate - exploiting this ciphertext attack could res…

  org.bitbucket.b_c:jose4j Maven
  Apr 27, 2023