CVE-2023-49290

Name of the Vulnerable Software and Affected Versions lestrrat-go/jwx versions prior to 1.2.27 lestrrat-go/jwx versions prior to 2.0.18

Description The issue is related to the JWE key management algorithms based on PBKDF2, which require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its primary purpose is to intentionally slow down the key derivation function, making password brute-force and dictionary attacks more resource-intensive. However, if an attacker sets the p2c parameter in JWE to a very large number, it can cause excessive computational consumption, resulting in a denial of service.

Recommendations For versions prior to 1.2.27, upgrade to version 1.2.27 or later. For versions prior to 2.0.18, upgrade to version 2.0.18 or later. As a temporary workaround, consider restricting the use of the p2c parameter in JWE to minimize the risk of exploitation.