CVE-2023-25653
published 2023-02-16CVE-2023-25653: node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for web browsers and node.js-based servers. Prior to version 2.2.0…
PriorityP338high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.55%
41.9th percentile
node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for web browsers and node.js-based servers. Prior to version 2.2.0, when using the non-default "fallback" crypto back-end, ECC operations in `node-jose` can trigger a Denial-of-Service (DoS) condition, due to a possible infinite loop in an internal calculation. For some ECC operations, this condition is triggered randomly; for others, it can be triggered by malicious input. The issue has been patched in version 2.2.0. Since this issue is only present in the "fallback" crypto implementation, it can be avoided by ensuring that either WebCrypto or the Node `crypto` module is available in the JS environment where `node-jose` is being run.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | node-jose | < 2.2.0 | 2.2.0 |
| cisco | node-jose | >= 0 < 2.2.0 | 2.2.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)
osv·2023-02-16
CVE-2023-25653 [HIGH] Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)
Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)
### Description
When using the non-default "fallback" crypto back-end, ECC operations in `node-jose` can trigger a Denial-of-Service (DoS) condition, due to a possible infinite loop in an internal calculation. For some ECC operations, this condition is triggered randomly; for others, it can be triggered by malicious input.
#### Technical summary
The JOSE logic implemented by `node-jose` usually relies on an external cryptographic library for the underlying cryptographic primitives that JOSE operations require. When WebCrypto or the Node `crypto` module are available, they are used. When neither of these libraries is available, `node-jose` includes its own "fallback" implementations of some algorithms base
GHSA
Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)
ghsa·2023-02-16
CVE-2023-25653 [HIGH] CWE-835 Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)
Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)
### Description
When using the non-default "fallback" crypto back-end, ECC operations in `node-jose` can trigger a Denial-of-Service (DoS) condition, due to a possible infinite loop in an internal calculation. For some ECC operations, this condition is triggered randomly; for others, it can be triggered by malicious input.
#### Technical summary
The JOSE logic implemented by `node-jose` usually relies on an external cryptographic library for the underlying cryptographic primitives that JOSE operations require. When WebCrypto or the Node `crypto` module are available, they are used. When neither of these libraries is available, `node-jose` includes its own "fallback" implementations of some algorithms base
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/cisco/node-jose/commit/901d91508a70e3b9bdfc45688ea07bb4e1b8210dhttps://github.com/cisco/node-jose/security/advisories/GHSA-5h4j-qrvg-9xhwhttps://github.com/cisco/node-jose/commit/901d91508a70e3b9bdfc45688ea07bb4e1b8210dhttps://github.com/cisco/node-jose/security/advisories/GHSA-5h4j-qrvg-9xhw
2023-02-16
Published