GHSA-9mg4-v392-8j68

Source

https://github.com/advisories/GHSA-9mg4-v392-8j68

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-9mg4-v392-8j68/GHSA-9mg4-v392-8j68.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9mg4-v392-8j68

Aliases

CVE-2023-50966

Published

2024-03-19T15:30:34Z

Modified

2025-12-10T00:48:48.347399Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

erlang-jose vulnerable to denial of service via large p2c value

Details

erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value in a JOSE header.

Database specific

{
    "nvd_published_at": "2024-03-19T15:15:07Z",
    "cwe_ids": [
        "CWE-400"
    ],
    "severity": "MODERATE",
    "github_reviewed_at": "2024-04-08T16:46:03Z",
    "github_reviewed": true
}

References

Affected packages

Hex / jose

Package

Name: jose
Purl: pkg:hex/jose

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.7

Affected versions

1.*

1.0.0

1.0.1

1.1.0

1.1.1

1.1.2

1.1.3

1.2.0

1.3.0

1.4.0

1.4.1

1.4.2

1.5.0

1.5.1

1.5.2

1.6.0

1.6.1

1.7.0

1.7.1

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

1.7.9

1.8.0

1.8.1

1.8.2

1.8.3

1.8.4

1.9.0

1.10.0

1.10.1

1.11.0

1.11.1

1.11.2

1.11.4

1.11.5

1.11.6