Inadequate Encryption Strength Affecting org.bitbucket.b_c:jose4j package, versions [,0.9.3)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGBITBUCKETBC-6036303
- published 26 Oct 2023
- disclosed 25 Oct 2023
- credit Unknown
Introduced: 25 Oct 2023
CVE-2023-31582 Open this link in a new tabHow to fix?
Upgrade org.bitbucket.b_c:jose4j to version 0.9.3 or higher.
Overview
org.bitbucket.b_c:jose4j is a robust and easy to use open source implementation of JSON Web Token (JWT) and the JOSE specification suite (JWS, JWE, and JWK). It is written in Java and relies solely on the JCA APIs for cryptography. Please see https://bitbucket.org/b_c/jose4j/wiki/Home for more info, examples, etc...
Affected versions of this package are vulnerable to Inadequate Encryption Strength through the iteration count setting, which can reduce the computational effort required to crack the encryption if it is set to a low value.