Miggo Logo
Miggo Vulnerability Database
→
GHSA-mhpq-9638-x6pw

GHSA-mhpq-9638-x6pw: Denial of service when decrypting attack controlled input in github.com/dvsekhvalnov/jose2go

5.3

CVSS Score
3.1

Basic Information

CVE ID
-
GHSA ID
GHSA-mhpq-9638-x6pw
EPSS Score
-
CWE
CWE-400
Published
12/20/2023
Updated
7/5/2024
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/dvsekhvalnov/jose2gogo< 1.5.1-0.20231206184617-48ba0b76bc881.5.1-0.20231206184617-48ba0b76bc88

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from processing unvalidated 'p2c' values during JWE decryption. The patch adds iteration count guards in Pbse2HmacAesKW.Unwrap, indicating this was the vulnerable function. The CWE-400 classification matches the uncontrolled resource consumption through cryptographic operations with attacker-controlled iteration counts. The test cases added in jose_test.go specifically target p2c validation failures in decryption operations handled by this function.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n *tt**k*r *ontroll** input o* * P**S* *n*rypt** JW* *lo* **n **v* * v*ry l*r** p** v*lu* t**t, w**n ***rypt**, pro*u**s * **ni*l-o*-s*rvi**.

Reasoning

T** vuln*r**ility st*ms *rom pro**ssin* unv*li**t** 'p**' v*lu*s *urin* JW* ***ryption. T** p*t** ***s it*r*tion *ount *u*r*s in P*s***m****sKW.Unwr*p, in*i**tin* t*is w*s t** vuln*r**l* *un*tion. T** *W*-*** *l*ssi*i**tion m*t***s t** un*ontroll** r