CVE-2023-31582 - Vulnerability Details - OpenCVE

jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00164.

Key SSVC decision points have not yet been added.

Vendors	Products
Jose4j Project	Jose4j
Redhat	Amq Streams Jboss Data Grid Quarkus

Configuration 1 [-]

cpe:2.3:a:jose4j_project:jose4j:*:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat AMQ Streams 2.6.0
jose4j	cpe:/a:redhat:amq_streams:2	RHSA-2023:7678	2023-12-06T00:00:00Z
Red Hat build of Quarkus 2.13.9.Final
org.bitbucket.b_c/jose4j:0.9.3.redhat-00004	cpe:/a:redhat:quarkus:2.13::el8	RHSA-2023:7700	2023-12-07T00:00:00Z
Red Hat Data Grid 8.4.6
jose4j	cpe:/a:redhat:jboss_data_grid:8	RHSA-2023:7676	2023-12-06T00:00:00Z

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-2687	jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.
Github GHSA	GHSA-7g24-qg88-p43q	jose4j uses weak cryptographic algorithm

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://bitbucket.org/b_c/jose4j/issues/203/insecure-support-of-setting-pbe-less-then
https://github.com/KANIXB/JWTIssues/blob/main/jose4j%20issue.md
https://nvd.nist.gov/vuln/detail/CVE-2023-31582
https://www.cve.org/CVERecord?id=CVE-2023-31582

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-10-24T00:00:00

Updated: 2024-09-11T18:37:34.066Z

Reserved: 2023-04-29T00:00:00

Link: CVE-2023-31582

Vulnrichment

Updated: 2024-08-02T14:53:30.902Z

NVD

Status : Modified

Published: 2023-10-25T18:17:27.777

Modified: 2024-11-21T08:02:03.167

Link: CVE-2023-31582

Redhat

Severity : Moderate

Publid Date: 2023-10-25T00:00:00Z

Links: CVE-2023-31582 - Bugzilla

OpenCVE Enrichment

No data.

{"affected_release": [{"advisory": "RHSA-2023:7678", "cpe": "cpe:/a:redhat:amq_streams:2", "package": "jose4j", "product_name": "Red Hat AMQ Streams 2.6.0", "release_date": "2023-12-06T00:00:00Z"}, {"advisory": "RHSA-2023:7700", "cpe": "cpe:/a:redhat:quarkus:2.13::el8", "package": "org.bitbucket.b_c/jose4j:0.9.3.redhat-00004", "product_name": "Red Hat build of Quarkus 2.13.9.Final", "release_date": "2023-12-07T00:00:00Z"}, {"advisory": "RHSA-2023:7676", "cpe": "cpe:/a:redhat:jboss_data_grid:8", "package": "jose4j", "product_name": "Red Hat Data Grid 8.4.6", "release_date": "2023-12-06T00:00:00Z"}], "bugzilla": {"description": "jose4j: Insecure iteration count setting", "id": "2246370", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2246370"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "status": "verified"}, "cwe": "CWE-331", "details": ["jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.", "A flaw was found in Jose4J which allows a malicious user or internal person to erroneously set a low iteration count of 1000 or less to secure the Json Web Token. This could apply to lack of entropy and leave the system less secure."], "mitigation": {"lang": "en:us", "value": "No mitigation is currently available for this flaw."}, "name": "CVE-2023-31582", "package_state": [{"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Not affected", "package_name": "jenkins-2-plugins", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Will not fix", "package_name": "jose4j", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Not affected", "package_name": "jose4j", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:3", "fix_state": "Will not fix", "package_name": "jose4j", "product_name": "Red Hat build of Apache Camel for Spring Boot 3"}, {"cpe": "cpe:/a:redhat:service_registry:2", "fix_state": "Affected", "package_name": "jose4j", "product_name": "Red Hat build of Apicurio Registry 2"}, {"cpe": "cpe:/a:redhat:debezium:2", "fix_state": "Will not fix", "package_name": "jose4j", "product_name": "Red Hat build of Debezium 2"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Not affected", "package_name": "org.bitbucket.b_c/jose4j", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Will not fix", "package_name": "jose4j", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:integration:1", "fix_state": "Will not fix", "package_name": "jose4j", "product_name": "Red Hat Integration Camel K 1"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:7", "fix_state": "Out of support scope", "package_name": "jose4j", "product_name": "Red Hat JBoss Data Grid 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6", "fix_state": "Out of support scope", "package_name": "jose4j", "product_name": "Red Hat JBoss Enterprise Application Platform 6"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6", "fix_state": "Out of support scope", "package_name": "keycloak-adapter-sso7_5-eap6", "product_name": "Red Hat JBoss Enterprise Application Platform 6"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Not affected", "package_name": "jose4j", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Not affected", "impact": "low", "package_name": "jose4j", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Not affected", "package_name": "jose4j", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Out of support scope", "package_name": "jenkins-2-plugins", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "jenkins-2-plugins", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7", "fix_state": "Will not fix", "package_name": "jose4j", "product_name": "Red Hat Process Automation 7"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Not affected", "package_name": "jose4j", "product_name": "Red Hat Single Sign-On 7"}], "public_date": "2023-10-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-31582\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-31582\nhttps://bitbucket.org/b_c/jose4j/issues/203/insecure-support-of-setting-pbe-less-then\nhttps://github.com/KANIXB/JWTIssues/blob/main/jose4j%20issue.md"], "statement": "This flaw would require manually setting of the number of iterations under 1000 for Json Web Encryption, therefore, a malicious user would need previous access to modify it. Also, a user would still be able to set the variable incorrectly and make the environment less secure for JWE. This is currently rated as a moderate impact.", "threat_severity": "Moderate"}