In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
Weakness
The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Jose4j | Jose4j_project | * | 0.9.5 (excluding) |
| Red Hat JBoss Enterprise Application Platform 8 | RedHat | * | |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-activemq-artemis-0:2.21.0-5.redhat_00052.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-angus-0:2.0.3-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-angus-activation-0:2.0.1-3.redhat_00006.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-apache-commons-beanutils-0:1.9.4-13.redhat_00004.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-apache-commons-cli-0:1.4.0-2.redhat_00003.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-apache-commons-codec-0:1.15.0-6.redhat_00016.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-apache-cxf-0:4.0.4-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-apache-cxf-xjc-utils-0:4.0.0-5.redhat_00003.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-apache-mime4j-0:0.8.11-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-apache-sshd-0:2.12.1-2.redhat_00002.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-bouncycastle-0:1.78.1-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-byte-buddy-0:1.14.18-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-caffeine-0:3.1.8-2.redhat_00002.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-eap-product-conf-parent-0:800.3.0-2.GA_redhat_00004.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-guava-failureaccess-0:1.0.2-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-guava-libraries-0:33.0.0-1.jre_redhat_00002.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-hal-console-0:3.6.19-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-hornetq-0:2.4.9-4.Final_redhat_00002.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-httpcomponents-asyncclient-0:4.1.5-3.redhat_00005.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-httpcomponents-client-0:4.5.14-4.redhat_00012.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-httpcomponents-core-0:4.4.16-4.redhat_00010.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-infinispan-0:14.0.30-2.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-jakarta-json-api-0:2.1.3-1.redhat_00002.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-jakarta-mail-0:2.1.3-1.redhat_00002.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-jakarta-servlet-api-0:6.0.0-5.redhat_00006.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-jakarta-websocket-0:2.1.1-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-jakarta-xml-bind-api-0:4.0.1-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-jandex-0:3.0.8-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-jasypt-0:1.9.3-4.redhat_00004.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-java-classmate-0:1.5.1-3.redhat_00004.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-jaxb-0:4.0.5-2.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-jboss-metadata-0:16.0.0-3.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-jboss-openjdk-orb-0:10.1.0-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-jbossws-cxf-0:7.1.0-1.Final_redhat_00002.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-joda-time-0:2.12.7-1.redhat_00002.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-jsf-impl-0:4.0.7-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-mod_cluster-0:2.0.3-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-neethi-0:3.2.0-1.redhat_00004.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-netty-0:4.1.108-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-netty-transport-native-epoll-0:4.1.108-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-netty-xnio-transport-0:0.1.10-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-opensaml-0:4.2.0-4.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-parsson-0:1.1.5-2.redhat_00002.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-reactivex-rxjava-0:3.1.8-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-resteasy-0:6.2.7-2.Final_redhat_00002.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-slf4j-0:2.0.13-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-stax2-api-0:4.2.2-1.redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-velocity-0:2.3.0-3.redhat_00009.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-weld-core-0:5.1.2-2.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-wildfly-0:8.0.3-9.GA_redhat_00004.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-wildfly-discovery-0:1.3.0-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-wildfly-elytron-0:2.2.6-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-wsdl4j-0:1.6.3-5.redhat_00008.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-wss4j-0:3.0.3-1.redhat_00008.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-xml-security-0:3.0.4-1.redhat_00005.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | RedHat | eap8-yasson-0:3.0.3-3.redhat_00002.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-activemq-artemis-0:2.21.0-5.redhat_00052.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-angus-0:2.0.3-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-angus-activation-0:2.0.1-3.redhat_00006.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-apache-commons-beanutils-0:1.9.4-13.redhat_00004.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-apache-commons-cli-0:1.4.0-2.redhat_00003.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-apache-commons-codec-0:1.15.0-6.redhat_00016.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-apache-cxf-0:4.0.4-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-apache-cxf-xjc-utils-0:4.0.0-5.redhat_00003.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-apache-mime4j-0:0.8.11-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-apache-sshd-0:2.12.1-2.redhat_00002.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-bouncycastle-0:1.78.1-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-byte-buddy-0:1.14.18-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-caffeine-0:3.1.8-2.redhat_00002.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-eap-product-conf-parent-0:800.3.0-2.GA_redhat_00004.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-guava-failureaccess-0:1.0.2-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-guava-libraries-0:33.0.0-1.jre_redhat_00002.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-hal-console-0:3.6.19-1.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-hornetq-0:2.4.9-4.Final_redhat_00002.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-httpcomponents-asyncclient-0:4.1.5-3.redhat_00005.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-httpcomponents-client-0:4.5.14-4.redhat_00012.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-httpcomponents-core-0:4.4.16-4.redhat_00010.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-infinispan-0:14.0.30-2.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-jakarta-json-api-0:2.1.3-1.redhat_00002.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-jakarta-mail-0:2.1.3-1.redhat_00002.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-jakarta-servlet-api-0:6.0.0-5.redhat_00006.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-jakarta-websocket-0:2.1.1-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-jakarta-xml-bind-api-0:4.0.1-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-jandex-0:3.0.8-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-jasypt-0:1.9.3-4.redhat_00004.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-java-classmate-0:1.5.1-3.redhat_00004.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-jaxb-0:4.0.5-2.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-jboss-metadata-0:16.0.0-3.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-jboss-openjdk-orb-0:10.1.0-1.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-jbossws-cxf-0:7.1.0-1.Final_redhat_00002.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-joda-time-0:2.12.7-1.redhat_00002.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-jsf-impl-0:4.0.7-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-mod_cluster-0:2.0.3-1.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-neethi-0:3.2.0-1.redhat_00004.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-netty-0:4.1.108-1.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-netty-transport-native-epoll-0:4.1.108-1.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-netty-xnio-transport-0:0.1.10-1.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-opensaml-0:4.2.0-4.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-parsson-0:1.1.5-2.redhat_00002.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-reactivex-rxjava-0:3.1.8-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-resteasy-0:6.2.7-2.Final_redhat_00002.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-slf4j-0:2.0.13-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-stax2-api-0:4.2.2-1.redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-velocity-0:2.3.0-3.redhat_00009.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-weld-core-0:5.1.2-2.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-wildfly-0:8.0.3-9.GA_redhat_00004.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-wildfly-discovery-0:1.3.0-1.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-wildfly-elytron-0:2.2.6-1.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-wsdl4j-0:1.6.3-5.redhat_00008.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-wss4j-0:3.0.3-1.redhat_00008.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-xml-security-0:3.0.4-1.redhat_00005.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | RedHat | eap8-yasson-0:3.0.3-3.redhat_00002.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.1.0 | RedHat | * | |
| Libjose4j-java | Ubuntu | plucky | * |