CVE-2023-51775

Name of the Vulnerable Software and Affected Versions jose4j versions prior to 0.9.4

Description The issue is related to the improper implementation of the PBES2 algorithm in the jose4j component when handling the p2c parameter. This can allow a remote attacker to cause a denial of service due to CPU consumption via a large p2c (aka PBES2 Count) value.

Recommendations For versions prior to 0.9.4, update to version 0.9.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the p2c parameter to minimize the risk of exploitation.