CVE-2023-37464

Name of the Vulnerable Software and Affected Versions OpenIDC/cjose versions prior to 0.6.2.2

Description The AES GCM decryption routine in OpenIDC/cjose incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE, instead of the fixed length of 16 octets specified in the spec. This allows an attacker to provide a truncated Authentication Tag and modify the JWE accordingly.

Recommendations For versions prior to 0.6.2.2, upgrade to a version >= 0.6.2.2. For users unable to upgrade, avoid using AES GCM encryption and replace it with another encryption algorithm, such as AES CBC.