CVE-2023-31582 — jose4j uses weak cryptographic algorithm

Description

jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	libjose4j-java	0.7.12-2	—
Debian 13	libjose4j-java	0.7.12-2	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.10	libjose4j-java	No fix yet	—
Ubuntu 26.04 LTS	libjose4j-java	No fix yet	—
Ubuntu 25.10	libjose4j-java	No fix yet	—
Ubuntu 24.04 LTS	libjose4j-java	No fix yet	—
Ubuntu 22.04 LTS	libjose4j-java	No fix yet	—

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SUSE Manager Server Module 4.3	cobbler	3.3.3-150400.5.39.5	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	grafana-formula	0.10.0-150400.3.15.5	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	inter-server-sync	0.3.2-150400.3.27.5	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	jose4j	0.5.1-150400.3.6.2	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	liberate-formula	0.1.0-150400.10.3.3	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	patterns-suse-manager	4.3-150400.5.9.5	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	prometheus-formula	0.8.0-150400.3.6.5	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	prometheus-postgres_exporter	0.10.1-150400.3.9.5	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	saltboot-formula	0.1.1701196218.b6b8ca1-150400.3.15.3	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	spacecmd	4.3.26-150400.3.33.5	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	spacewalk-backend	4.3.27-150400.3.38.2	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	spacewalk-certs-tools	4.3.22-150400.3.25.1	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	spacewalk-client-tools	4.3.18-150400.3.24.7	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	spacewalk-java	4.3.71-150400.3.74.2	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	spacewalk-setup	4.3.19-150400.3.30.5	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	spacewalk-utils	4.3.19-150400.3.21.5	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	spacewalk-web	4.3.37-150400.3.39.7	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	subscription-matcher	0.35-150400.3.19.5	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	supportutils-plugin-susemanager	4.3.10-150400.3.18.5	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	susemanager	4.3.34-150400.3.45.5	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	susemanager-build-keys	15.4.10-150400.3.23.5	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	susemanager-docs_en	4.3-150400.9.53.5	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	susemanager-schema	4.3.24-150400.3.36.7	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	susemanager-sls	4.3.40-150400.3.44.1	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	susemanager-sync-data	4.3.16-150400.3.22.2	SUSE-SU-2024:0485-1
SUSE Manager Server Module 4.3	uyuni-reportdb-schema	4.3.9-150400.3.12.7	SUSE-SU-2024:0485-1
SUSE Manager Proxy Module 4.3	mgr-daemon	4.3.8-150400.3.12.5	SUSE-SU-2024:0485-1
SUSE Manager Proxy Module 4.3	patterns-suse-manager	4.3-150400.5.9.5	SUSE-SU-2024:0485-1
SUSE Manager Proxy Module 4.3	spacecmd	4.3.26-150400.3.33.5	SUSE-SU-2024:0485-1
SUSE Manager Proxy Module 4.3	spacewalk-backend	4.3.27-150400.3.38.2	SUSE-SU-2024:0485-1
SUSE Manager Proxy Module 4.3	spacewalk-certs-tools	4.3.22-150400.3.25.1	SUSE-SU-2024:0485-1
SUSE Manager Proxy Module 4.3	spacewalk-client-tools	4.3.18-150400.3.24.7	SUSE-SU-2024:0485-1
SUSE Manager Proxy Module 4.3	spacewalk-web	4.3.37-150400.3.39.7	SUSE-SU-2024:0485-1
SUSE Manager Proxy Module 4.3	susemanager-build-keys	15.4.10-150400.3.23.5	SUSE-SU-2024:0485-1

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.bitbucket.b_c:jose4j	< 0.9.3	0.9.3	GHSA-7g24-qg88-p43q

Advisories 7

SUSE-SU-2024:0485-1 Security update for SUSE Manager Server 4.3 SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2023-3070 Red Hat JBoss A-MQ: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 16, 2025
WID-SEC-2024-3684 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 11, 2024
WID-SEC-2024-1129 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 14, 2024
WID-SEC-2024-0277 IBM Business Automation Workflow: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 1, 2024
WID-SEC-2023-3071 Red Hat JBoss Data Grid: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 25, 2024
WID-SEC-2024-0106 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024

jose4j uses weak cryptographic algorithm

Description

Fixed in Linux distributions

Debian

Ubuntu

SUSE

Affected packages

Advisories 7

References