CVE-2023-51775

EUVD-2024-0539
The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CISA-ADPADP
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 62%
Affected Products (NVD)
VendorProductVersion
jose4j_projectjose4j
𝑥
< 0.9.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libjose4j-java
sid
0.9.6-1
fixed
trixie
0.9.6-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libjose4j-java
bionic
ignored
focal
dne
jammy
needs-triage
lunar
ignored
mantic
ignored
noble
needs-triage
oracular
needs-triage
trusty
ignored
xenial
ignored
Common Weakness Enumeration
References
https://bitbucket.org/b_c/jose4j/issues/212
https://bitbucket.org/b_c/jose4j/issues/212
https://security.netapp.com/advisory/ntap-20241108-0002/