In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Nimbus_jose+jwt | Connect2id | * | 9.37.2 (excluding) |
| Red Hat build of Apache Camel 3.20.7 for Spring Boot | RedHat | com.nimbusds/nimbus-jose-jwt | * |
| Red Hat build of Apache Camel 4.4.3 for Spring Boot | RedHat | com.nimbusds/nimbus-jose-jwt | * |
| Red Hat JBoss Enterprise Application Platform 8 | RedHat | com.nimbusds/nimbus-jose-jwt | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-activemq-artemis-0:2.33.0-1.redhat_00015.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-activemq-artemis-native-1:2.0.0-2.redhat_00005.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-aesh-extensions-0:1.8.0-2.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-aesh-readline-0:2.2.0-2.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-apache-commons-codec-0:1.16.1-2.redhat_00007.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-apache-commons-collections-0:3.2.2-28.redhat_2.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-apache-commons-io-0:2.15.1-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-apache-commons-lang-0:3.14.0-2.redhat_00006.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-apache-cxf-0:4.0.5-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-artemis-native-1:2.0.0-2.redhat_00005.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-artemis-wildfly-integration-0:2.0.1-1.redhat_00002.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-asyncutil-0:0.1.0-2.redhat_00010.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-aws-java-sdk-0:1.12.284-2.redhat_00002.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-cryptacular-0:1.2.5-2.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-eap-product-conf-parent-0:800.4.0-1.GA_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-fastinfoset-0:2.1.0-4.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-hibernate-0:6.2.31-1.Final_redhat_00002.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-hibernate-validator-0:8.0.1-3.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-hppc-0:0.8.1-2.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-insights-java-client-0:1.1.3-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-jakarta-servlet-jsp-jstl-api-0:3.0.1-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-jboss-cert-helper-0:1.1.3-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-jboss-logging-0:3.5.3-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-jctools-0:4.0.2-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-jgroups-0:5.3.10-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-log4j-0:2.22.1-1.redhat_00002.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-narayana-0:6.0.3-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-nimbus-jose-jwt-0:9.37.3-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-objectweb-asm-0:9.6.0-1.redhat_00002.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-pem-keystore-0:2.3.0-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-resteasy-extensions-0:2.0.1-3.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-resteasy-spring-0:3.0.1-2.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-saaj-impl-0:3.0.4-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-shibboleth-java-support-0:8.0.0-6.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-slf4j-0:2.0.16-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-snakeyaml-0:2.2.0-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-wildfly-0:8.0.4-2.GA_redhat_00005.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-activemq-artemis-0:2.33.0-1.redhat_00015.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-activemq-artemis-native-1:2.0.0-2.redhat_00005.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-aesh-extensions-0:1.8.0-2.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-aesh-readline-0:2.2.0-2.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-apache-commons-codec-0:1.16.1-2.redhat_00007.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-apache-commons-collections-0:3.2.2-28.redhat_2.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-apache-commons-io-0:2.15.1-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-apache-commons-lang-0:3.14.0-2.redhat_00006.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-apache-cxf-0:4.0.5-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-artemis-native-1:2.0.0-2.redhat_00005.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-artemis-wildfly-integration-0:2.0.1-1.redhat_00002.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-asyncutil-0:0.1.0-2.redhat_00010.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-aws-java-sdk-0:1.12.284-2.redhat_00002.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-cryptacular-0:1.2.5-2.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-eap-product-conf-parent-0:800.4.0-1.GA_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-fastinfoset-0:2.1.0-4.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-hibernate-0:6.2.31-1.Final_redhat_00002.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-hibernate-validator-0:8.0.1-3.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-hppc-0:0.8.1-2.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-insights-java-client-0:1.1.3-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-jakarta-servlet-jsp-jstl-api-0:3.0.1-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-jboss-cert-helper-0:1.1.3-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-jboss-logging-0:3.5.3-1.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-jctools-0:4.0.2-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-jgroups-0:5.3.10-1.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-log4j-0:2.22.1-1.redhat_00002.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-narayana-0:6.0.3-1.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-nimbus-jose-jwt-0:9.37.3-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-objectweb-asm-0:9.6.0-1.redhat_00002.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-pem-keystore-0:2.3.0-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-resteasy-extensions-0:2.0.1-3.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-resteasy-spring-0:3.0.1-2.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-saaj-impl-0:3.0.4-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-shibboleth-java-support-0:8.0.0-6.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-slf4j-0:2.0.16-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-snakeyaml-0:2.2.0-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-wildfly-0:8.0.4-2.GA_redhat_00005.1.el9eap | * |