Allocation of Resources Without Limits or Throttling Affecting com.nimbusds:nimbus-jose-jwt package, versions [,9.37.2)
Threat Intelligence
EPSS
0.05% (20th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-COMNIMBUSDS-6247633
- published 15 Feb 2024
- disclosed 11 Feb 2024
- credit Unknown
Introduced: 11 Feb 2024
CVE-2023-52428 Open this link in a new tabHow to fix?
Upgrade com.nimbusds:nimbus-jose-jwt to version 9.37.2 or higher.
Overview
com.nimbusds:nimbus-jose-jwt is a library for JSON Web Tokens (JWT)
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to a large JWE p2c header value (AKA iteration count) for the PasswordBasedDecrypter (PBKDF2) class. An attacker can cause resource consumption by specifying an excessively large iteration count.
References
CVSS Scores
version 3.1