Improper resource allocation In github.com/square/go-jose
Description
Decryption of malicious PBES2 JWE objects can consume unbounded system resources The go-jose package is subject to a "billion hashes attack" causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-service.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 go | 2.6.2 | ||
go | 3.0.1 |
Aliases
1.
References
1. 2. 3.