Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)

Description

When using the non-default “fallback” crypto back-end, ECC operations in node-jose can trigger a Denial-of-Service (DoS) condition, due to a possible infinite loop in an internal calculation. For some ECC operations, this condition is triggered randomly; for others, it can be triggered by malicious input.

Recommendation

Update the node-jose package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.2.0
• Patched version(s): 2.2.0

References

• GHSA-5h4j-qrvg-9xhw
• CVE-2023-25653
• CWE-835
• CAPEC-310
• OWASP 2021-A6

Related Issues

• angular vulnerable to regular expression denial of service via the $resource service - CVE-2023-26117
• Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter - CVE-2022-24901
• Prototype pollution in Plist before 3.0.5 can cause denial of service - CVE-2022-22912
• Denial of Service (DoS) vulnerability in RSSHub - CVE-2022-31110

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

node-jose