CVE-2023-6681
published 2024-02-12CVE-2023-6681: A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary…
PriorityP424medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.88%
55.1th percentile
A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue can result in a large amount of computational consumption, causing a denial of service attack.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-jwcrypto | < python-jwcrypto 1.5.4-1 (forky) | python-jwcrypto 1.5.4-1 (forky) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| latchset | jwcrypto | < 1.5.1 | 1.5.1 |
| latchset | jwcrypto | >= 0 < 1.5.1 | 1.5.1 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_for_arm_64 | — | — |
| redhat | enterprise_linux_for_ibm_z_systems | — | — |
| redhat | enterprise_linux_for_power_little_endian | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
osv5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
JWCrypto: denail of service Via specifically crafted JWE
vendor_redhat·2023-12-28·CVSS 5.3
CVE-2023-6681 [MEDIUM] CWE-400 JWCrypto: denail of service Via specifically crafted JWE
JWCrypto: denail of service Via specifically crafted JWE
A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue can result in a large amount of computational consumption, causing a denial of service attack.
A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue can result in a large amount of computational consumption, causing a denial of service attack.
Statement: The identified vulnerability within the jwcrypto package, presents a moderate severity concern rather than a important on
Debian
CVE-2023-6681: python-jwcrypto - A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a d...
vendor_debian·2023·CVSS 5.3
CVE-2023-6681 [MEDIUM] CVE-2023-6681: python-jwcrypto - A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a d...
A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue can result in a large amount of computational consumption, causing a denial of service attack.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 1.5.4-1)
sid: resolved (fixed in 1.5.4-1)
trixie: resolved (fixed in 1.5.4-1)
OSV
CVE-2023-6681: A vulnerability was found in JWCrypto
osv·2024-02-12·CVSS 5.3
CVE-2023-6681 [MEDIUM] CVE-2023-6681: A vulnerability was found in JWCrypto
A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue can result in a large amount of computational consumption, causing a denial of service attack.
OSV
DoS with algorithms that use PBKDF2 due to unbounded PBES2 Count value
osv·2023-12-28
CVE-2023-6681 [MEDIUM] DoS with algorithms that use PBKDF2 due to unbounded PBES2 Count value
DoS with algorithms that use PBKDF2 due to unbounded PBES2 Count value
### Impact
Denial of Service,
Applications that allow the use of the PBKDF2 algorithm.
### Patches
A [patch](https://github.com/latchset/jwcrypto/commit/d2655d370586cb830e49acfb450f87598da60be8) is available that sets the maximum number of default rounds.
### Workarounds
Applications that do not need to use PBKDF2 should simply specify the algorithms use and exclude it from the list.
Applications that need to use the algorithm should upgrade to the new version that allows to set a maximum rounds number.
### Acknowledgement
The issues was reported by Jingcheng Yang and Jianjun Chen from Sichuan University
and Zhongguancun Lab
GHSA
DoS with algorithms that use PBKDF2 due to unbounded PBES2 Count value
ghsa·2023-12-28
CVE-2023-6681 [MEDIUM] CWE-400 DoS with algorithms that use PBKDF2 due to unbounded PBES2 Count value
DoS with algorithms that use PBKDF2 due to unbounded PBES2 Count value
### Impact
Denial of Service,
Applications that allow the use of the PBKDF2 algorithm.
### Patches
A [patch](https://github.com/latchset/jwcrypto/commit/d2655d370586cb830e49acfb450f87598da60be8) is available that sets the maximum number of default rounds.
### Workarounds
Applications that do not need to use PBKDF2 should simply specify the algorithms use and exclude it from the list.
Applications that need to use the algorithm should upgrade to the new version that allows to set a maximum rounds number.
### Acknowledgement
The issues was reported by Jingcheng Yang and Jianjun Chen from Sichuan University
and Zhongguancun Lab
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://access.redhat.com/errata/RHSA-2024:3267https://access.redhat.com/errata/RHSA-2024:9281https://access.redhat.com/security/cve/CVE-2023-6681https://bugzilla.redhat.com/show_bug.cgi?id=2260843https://access.redhat.com/errata/RHSA-2024:3267https://access.redhat.com/security/cve/CVE-2023-6681https://bugzilla.redhat.com/show_bug.cgi?id=2260843
2024-02-12
Published