TI-2021-10157 Aliases CVE-2021-29444 GHSA-94hh-pjjg-rwmr

Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime

LOW 29CWE-203Published 2021-04-16 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-203.

Summary

jose-browser-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. But a possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). A patch was released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `>=3.11.4`. Users should upgrade to `^3.11.4`.

Why it matters now

EPSS 0.01067 64th percentileScored 2026-11-07

Fix Fixed jose (panva): 3.11.4jose-browser-runtime (npm): 3.11.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
panva	jose	before 3.11.4	3.11.4	Patch available	CNA
—	jose-browser-runtime (npm)	before 3.11.4	3.11.4	Patch available	GHSA-94hh-pjjg-rwmr

jose Vendorpanva Affected before 3.11.4 Fixed in 3.11.4 Patch available CNA
jose-browser-runtime (npm) Vendor— Affected before 3.11.4 Fixed in 3.11.4 Patch available GHSA-94hh-pjjg-rwmr

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jose-node-cjs-runtime_project:jose-node-cjs-runtime::::::node.js::*	before 3.11.4	Vulnerable	Jose-node-cjs-runtime Project

cpe:2.3:a:jose-node-cjs-runtime_project:jose-node-cjs-runtime:*:*:*:*:*:node.js:*:* Versions before 3.11.4 Vulnerable ·Jose-node-cjs-runtime Project

Remediation

Fix · CNA jose (panva) Fixed in 3.11.4
Fix · GHSA-94hh-pjjg-rwmr jose-browser-runtime (npm) Fixed in 3.11.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-29444
2026-10-03 Alias added: GHSA-94hh-pjjg-rwmr

References

Advisory 3

Other 1

https://github.com/panva/jose

TI-2022-16506 JOSE vulnerable to resource exhaustion via specifically crafted JWE CVSS 3.1MEDIUM 5.3
TI-2024-18754 jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext CVSS 3.1MEDIUM 5.9
TI-2021-10159 Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime CVSS 3.1MEDIUM 5.9
TI-2021-10158 Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtime CVSS 3.1MEDIUM 5.9
TI-2021-10156 Padding Oracle Attack due to Observable Timing Discrepancy in jose CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences