GHSA-2c7c-3mj9-8fqh: Decryption of malicious PBES2 JWE objects can consume unbounded system resources
(updated )
The go-jose package is subject to a “billion hashes attack” causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-service.
References
Code Behaviors & Features
Detect and mitigate GHSA-2c7c-3mj9-8fqh with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →