DEBIAN-CVE-2026-53939
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-53939
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-53939.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-53939
- Upstream
- Published
- 2026-09-09T00:17:31Z
- Modified
- 2026-09-15T21:00:09Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm (
A128CBC-HS256,A192CBC-HS384, orA256CBC-HS512) together with any key-management algorithm that generates a fresh content-encryption key (CEK), the CEK is all zero bytes instead of being randomly generated. The resulting JWE is therefore encrypted and authenticated under a fixed, publicly known key, so anyone who obtains the JWE can recover the plaintext and forge or modify the content. This is fixed in version 0.6.2.6 by_cjose_jwe_set_cek_aes_cbc()generating the CEK fromRAND_bytes. A regression test asserts that theencrypted_keydiffers across two encryptions for each AES-CBC-HMAC variant. Until upgrading, for data encrypted with cjose, three options are available. Use an AES-GCMenc(A128GCM/A192GCM/A256GCM) instead of an AES-CBC-HMACenc, usealg=dirwith a caller-supplied CEK, or avoid using cjose for JWE encryption with the affected algorithm pair. These are mitigations for new ciphertexts only; data already encrypted under the zero key remains compromised and should be re-encrypted (and any secrets it contained rotated). - References
Affected packages
Debian:12 / cjose
Package
- Name
- cjose
- Purl
- pkg:deb/debian/cjose?arch=source&distro=bookworm
Debian:13 / cjose
Package
- Name
- cjose
- Purl
- pkg:deb/debian/cjose?arch=source&distro=trixie
Debian:14 / cjose
Package
- Name
- cjose
- Purl
- pkg:deb/debian/cjose?arch=source&distro=forky