VDB
BDU%3A2024-00592
BDU%3A2024-00592
PUBLISHED
CVSS 7.800000190734863 HIGH
Уязвимость JWT-библиотеки Jose4j, связанная с использованием алгоритма, обеспечивающего недостаточную энтропию, позволяющая нарушителю обойти ограничения безопасности
Risk Scores
CVSS 2.0
7.800000190734863
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat Inc., Сообщество свободного программного обеспечения, Oracle Corp. | Red Hat Process Automation, Red Hat Integration Service Registry, Jose4j, Red Hat Data Grid, Red Hat AMQ Streams, Oracle Communications Cloud Native Core Unified Data Repository, Oracle Communications Cloud Native Core Network Repository Function, Communications Cloud Native Core Network Exposure Function |
Timeline
- Jan 24, 2024 CVE Published
- Apr 17, 2024 CVE Updated
References
- https://safe-surf.ru/upload/VULN-new/VULN.2024-01-19.1.pdf url
- https://access.redhat.com/security/cve/cve-2023-31582 url
- https://bitbucket.org/b_c/jose4j/issues/203/insecure-support-of-setting-pbe-less-then url
- https://github.com/KANIXB/JWTIssues/blob/main/jose4j%20issue.md url
- https://www.oracle.com/security-alerts/cpujan2024.html url
- https://www.oracle.com/security-alerts/cpujan2024verbose.html#CGBU url
- https://bitbucket.org/b_c/jose4j/commits/1929fe3 advisory