medium5.3
CVE-2023-50966
erlang-jose vulnerable to denial of service via large p2c value
Impact
erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value in a JOSE header.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| erlang | jose | < 1.11.7 | 1.11.7 |
Affected products
| Product | Affected versions |
|---|---|
| Erlang-Jose (Aka JOSE For Erlang And Elixir) | through 1.11.6 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/P3ngu1nW/CVE_Request/blob/main/erlang-jose.md
- https://github.com/potatosalad/erlang-jose
- https://hexdocs.pm/jose/JOSE.html
- https://github.com/advisories/GHSA-9mg4-v392-8j68
- https://nvd.nist.gov/vuln/detail/CVE-2023-50966
- https://github.com/potatosalad/erlang-jose/commit/718d213f07b08056737923f8063d5df56dcb66ae