CVE-2023-50658: 
CBL Mariner vulnerability analysis and mitigation

The jose2go component before version 1.6.0 for Go contains a vulnerability that allows attackers to cause a denial of service through CPU consumption by manipulating the p2c (PBES2 Count) value. This security issue was assigned CVE-2023-50658 and was addressed in version 1.6.0 of the library (GitHub Commit).

The vulnerability exists in the PBES2 (Password-Based Encryption Scheme 2) implementation of the jose2go library, specifically affecting the HMAC key management algorithm. The issue stems from the lack of proper validation on the p2c (iteration count) parameter, which could be set to arbitrarily large values. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High), with attack vector being Network, attack complexity Low, and requiring No privileges or user interaction (Ubuntu CVE).

When exploited, this vulnerability can lead to denial of service conditions through excessive CPU consumption. The attack can be triggered remotely by manipulating the p2c value in PBES2-based JWT tokens, causing the server to perform an excessive number of iterations during the key derivation process (Debian Tracker).

The vulnerability has been fixed in jose2go version 1.6.0 by implementing iteration count limits according to OWASP PBKDF2 recommendations. The fix introduces maximum iteration counts of 1,300,000 for PBES2-HS256+A128KW, 950,000 for PBES2-HS384+A192KW, and 600,000 for PBES2-HS512+A256KW. Users should upgrade to version 1.6.0 or later to receive these security improvements (GitHub Compare).