Vulnerabilities

TI-2024-18754 CVE-2024-28176 · GHSA-hhhv-q57g-882q

jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

LOW 31

jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.02102 Published 2024-03-09 Partial fix · 2.0.7, 4.15.5 CWE-400

TI-2022-16506 CVE-2022-36083 · GHSA-jv3g-j58f-9mq9

JOSE vulnerable to resource exhaustion via specifically crafted JWE

MEDIUM 63

JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01639 Published 2022-09-07 Fixed in 1.28.2, 2.0.6 +2 CWE-400

TI-2021-10159 CVE-2021-29446 · GHSA-rvcw-f68w-8h8h

Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime

LOW 29

jose-node-cjs-runtime is an npm package which provides a number of cryptographic functions.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01067 Published 2021-04-16 Fixed in 3.11.4 CWE-203

TI-2021-10158 CVE-2021-29445 · GHSA-4v4g-726h-xvfv

Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtime

LOW 29

jose-node-esm-runtime is an npm package which provides a number of cryptographic functions.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01067 Published 2021-04-16 Fixed in 3.11.4 CWE-203

TI-2021-10157 CVE-2021-29444 · GHSA-94hh-pjjg-rwmr

Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime

LOW 29

jose-browser-runtime is an npm package which provides a number of cryptographic functions.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01067 Published 2021-04-16 Fixed in 3.11.4 CWE-203

TI-2021-10156 CVE-2021-29443 · GHSA-58f5-hfqc-jgch

Padding Oracle Attack due to Observable Timing Discrepancy in jose

LOW 29

jose is an npm library providing a number of cryptographic operations.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01167 Published 2021-04-16 Fixed in 1.28.1, 2.0.5 +1 CWE-203

Vulnerabilities

Filters

jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

JOSE vulnerable to resource exhaustion via specifically crafted JWE

Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime

Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtime

Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime

Padding Oracle Attack due to Observable Timing Discrepancy in jose