Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Impact Assessment] CVE-2023-52428 in com.nimbusds:nimbus-jose-jwt #1811

Open
asthagarg2428 opened this issue Oct 21, 2024 · 0 comments
Open

[Impact Assessment] CVE-2023-52428 in com.nimbusds:nimbus-jose-jwt #1811

asthagarg2428 opened this issue Oct 21, 2024 · 0 comments

Comments

@asthagarg2428
Copy link

asthagarg2428 commented Oct 21, 2024 •
edited
Loading

ADAL is using very old nimbusVersion 9.9 which has a vulnerability (CVE-2023-52428)
CVE-2023-52428 Denial of Service in Connect2id Nimbus JOSE+JWT In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.

Can you help us with the impact assessment of this vulnerability?
@asthagarg2428 asthagarg2428 changed the title CVE-2023-52428 in com.nimbusds:nimbus-jose-jwt [Impact Assessment] CVE-2023-52428 in com.nimbusds:nimbus-jose-jwt Oct 22, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@asthagarg2428