Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)

Description

When using the non-default “fallback” crypto back-end, ECC operations in node-jose can trigger a Denial-of-Service (DoS) condition, due to a possible infinite loop in an internal calculation. For some ECC operations, this condition is triggered randomly; for others, it can be triggered by malicious input.

Recommendation

Update the node-jose package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.2.0
• Patched version(s): 2.2.0

References

• GHSA-5h4j-qrvg-9xhw
• CVE-2023-25653
• CWE-835
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Unauthenticated Denial of Service in the octokit/webhooks library - CVE-2023-50728
• Unauthenticated Denial of Service in the octokit/webhooks library (GHSA-pwfr-8pq7-x9qv) - CVE-2023-50728
• Unauthenticated Denial of Service in the octokit/webhooks library (GHSA-pwfr-8pq7-x9qv) 2 - CVE-2023-50728
• msgpackr's conversion of property names to strings can trigger infinite recursion - CVE-2023-52079

Tags:

npm

node-jose