VDB
BDU%3A2024-00592
BDU%3A2024-00592
PUBLISHED
CVSS 7.800000190734863 HIGH
Уязвимость JWT-библиотеки Jose4j, связанная с использованием алгоритма, обеспечивающего недостаточную энтропию, позволяющая нарушителю обойти ограничения безопасности
Risk Scores
CVSS 2.0
7.800000190734863
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat, Inc., Сообщество свободного программного обеспечения, Oracle Corp., ООО «РусБИТех-Астра» | Red Hat Process Automation, Red Hat Integration Service Registry, Jose4j, Red Hat Data Grid, Red Hat AMQ Streams, Oracle Communications Cloud Native Core Unified Data Repository, Oracle Communications Cloud Native Core Network Repository Function, Communications Cloud Native Core Network Exposure Function, ПК СВ «Брест» | |
| Red Hat Inc., Сообщество свободного программного обеспечения, Oracle Corp. | Red Hat Process Automation, Red Hat Integration Service Registry, Jose4j, Red Hat Data Grid, Red Hat AMQ Streams, Oracle Communications Cloud Native Core Unified Data Repository, Oracle Communications Cloud Native Core Network Repository Function, Communications Cloud Native Core Network Exposure Function |
Timeline
- Jan 24, 2024 CVE Published
- Aug 4, 2026 CVE Updated
References
- https://safe-surf.ru/upload/VULN-new/VULN.2024-01-19.1.pdf url
- https://access.redhat.com/security/cve/cve-2023-31582 advisory
- https://bitbucket.org/b_c/jose4j/issues/203/insecure-support-of-setting-pbe-less-then url
- https://github.com/KANIXB/JWTIssues/blob/main/jose4j%20issue.md url
- https://www.oracle.com/security-alerts/cpujan2024.html advisory
- https://www.oracle.com/security-alerts/cpujan2024verbose.html#CGBU url
- https://wiki.astralinux.ru/x/ziLoD advisory
- https://bitbucket.org/b_c/jose4j/commits/1929fe3 advisory
- https://lk.astralinux.ru/ advisory