Skip to content
OpenAdvisories
High · 7.5 CVE-2023-52428 EUVD-2024-0644GHSA-gvpg-vgmx-xg6w

Denial of Service in Connect2id Nimbus JOSE+JWT

Published Feb 11, 2024 · Updated Oct 30, 2024 · Assigned by mitre

Package: celeborn-0.6 Package: com.nimbusds:nimbus-jose-jwt Package: dependency-track Package: dependency-track-bundled Package: druid Package: sonarqube-10 Package: tez Package: thingsboard Package: thingsboard-tb-js-executor Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: thingsboard-tb-web-ui Ecosystem: Maven Ecosystem: Wolfi

Description

In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 8 eap8-activemq-artemis +14 2.33.0-1.redhat_00015.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-aesh-extensions 1.8.0-2.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-aesh-readline 2.2.0-2.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-apache-commons-codec 1.16.1-2.redhat_00007.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-apache-commons-collections 3.2.2-28.redhat_2.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-apache-commons-io 2.15.1-1.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-apache-commons-lang 3.14.0-2.redhat_00006.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-apache-cxf +3 4.0.5-1.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-artemis-native +2 1:2.0.0-2.redhat_00005.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-artemis-wildfly-integration 2.0.1-1.redhat_00002.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-asyncutil 0.1.0-2.redhat_00010.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-aws-java-sdk +4 1.12.284-2.redhat_00002.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-cryptacular 1.2.5-2.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-eap-product-conf-parent +1 800.4.0-1.GA_redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-fastinfoset 2.1.0-4.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-hibernate +2 6.2.31-1.Final_redhat_00002.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-hibernate-validator +1 8.0.1-3.Final_redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-hppc 0.8.1-2.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-jakarta-servlet-jsp-jstl +1 3.0.1-1.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-jboss-cert-helper +1 1.1.3-1.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-jboss-logging 3.5.3-1.Final_redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-jctools +1 4.0.2-1.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-jgroups 5.3.10-1.Final_redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-log4j 2.22.1-1.redhat_00002.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-narayana +8 6.0.3-1.Final_redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-nimbus-jose-jwt 9.37.3-1.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-objectweb-asm +1 9.6.0-1.redhat_00002.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-pem-keystore 2.3.0-1.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-resteasy-extensions +1 2.0.1-3.Final_redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-resteasy-spring 3.0.1-2.Final_redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-saaj-impl 3.0.4-1.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-shibboleth-java-support 8.0.0-6.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-slf4j +1 2.0.16-1.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-snakeyaml 2.2.0-1.redhat_00001.1.el8eap RHSA-2024:8824, RHSA-2024:8823
Red Hat JBoss EAP 8 eap8-wildfly +4 8.0.4-2.GA_redhat_00005.1.el8eap RHSA-2024:8824, RHSA-2024:8823

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling celeborn-0.6 0.6.3-r7 —
Wolfi rolling dependency-track +1 4.10.1-r3 —
Wolfi rolling druid 34.0.0-r6 —
Wolfi rolling sonarqube-10 25.1.0.102122-r0 —
Wolfi rolling tez 0.10.4-r6 —
Wolfi rolling thingsboard +4 3.7-r2 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.nimbusds:nimbus-jose-jwt < 9.37.2 9.37.2 GHSA-gvpg-vgmx-xg6w

Advisories 20

References