Fluid Attacks Database

Description

erlang-jose vulnerable to denial of service via large p2c value erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value in a JOSE header.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 14	erlang-jose	>=0 <1.11.10-1	1.11.10-1
debian 11	erlang-jose	=1.11.1-3 \|\| =1.11.10-1 \|\| =1.11.10-1~bpo12+1 \|\| =1.11.12-1 \|\| =1.11.2-1 \|\| =1.11.2-1~bpo11+1 \|\| =1.11.2-2 \|\| =1.11.2-2~bpo11+1 \|\| =1.11.5-1 \|\| =1.11.5-1~bpo11+1 \|\| =1.11.6-1 \|\| =1.11.6-1~bpo12+1	-
debian 12	erlang-jose	=1.11.10-1 \|\| =1.11.10-1~bpo12+1 \|\| =1.11.12-1 \|\| =1.11.5-1 \|\| =1.11.6-1 \|\| =1.11.6-1~bpo12+1	-
debian 13	erlang-jose	>=0 <1.11.10-1	1.11.10-1
hex	jose	=1.0.0 \|\| =1.0.1 \|\| =1.1.0 \|\| =1.1.1 \|\| =1.1.2 \|\| =1.1.3 \|\| =1.10.0 \|\| =1.10.1 \|\| =1.11.0 \|\| =1.11.1 \|\| =1.11.2 \|\| =1.11.4 \|\| =1.11.5 \|\| =1.11.6 \|\| =1.2.0 \|\| =1.3.0 \|\| =1.4.0 \|\| =1.4.1 \|\| =1.4.2 \|\| =1.5.0 \|\| =1.5.1 \|\| =1.5.2 \|\| =1.6.0 \|\| =1.6.1 \|\| =1.7.0 \|\| =1.7.1 \|\| =1.7.2 \|\| =1.7.3 \|\| =1.7.4 \|\| =1.7.5 \|\| =1.7.6 \|\| =1.7.7 \|\| =1.7.8 \|\| =1.7.9 \|\| =1.8.0 \|\| =1.8.1 \|\| =1.8.2 \|\| =1.8.3 \|\| =1.8.4 \|\| =1.9.0 \|\| >=0 <1.11.7	1.11.7

Aliases

1. CVE-2023-509662. NVD-2023-509663. OSV-DEBIAN-2023-509664. OSV-2023-509665. OSV-GHSA-9mg4-v392-8j686. GCVE-2023-509667. SECURITY-TRACKER-CVE-2023-50966

References

1. https://github.com/potatosalad/erlang-jose/commit/718d213f07b08056737923f8063d5df56dcb66ae2. https://github.com/P3ngu1nW/CVE_Request/blob/main/erlang-jose.md3. https://hexdocs.pm/jose/JOSE.html