CVE-2023-50967: 
NixOS vulnerability analysis and mitigation

A vulnerability was discovered in latchset jose through version 11 that allows attackers to cause a denial of service through CPU consumption. The vulnerability (CVE-2023-50967) is related to the JOSE Header Parameter called p2c (PBES2 Count), which can be exploited by setting a large value to trigger uncontrolled resource consumption (Red Hat Portal).

The vulnerability exists in the JWE key management algorithms that use a JOSE Header Parameter called p2c (PBES2 Count). This parameter controls the PBKDF2 iterations used to derive a CEK wrapping key. When an attacker sets p2c to an excessively high value, it leads to excessive computational use and potential denial of service (Red Hat Portal). The vulnerability has been assigned a CVSS v3 Base Score of 7.5 (High) with the vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (Red Hat Portal).

The primary impact of this vulnerability is on system availability. When exploited, it can lead to excessive CPU consumption and denial of service, affecting the availability of the targeted application. The vulnerability has no impact on confidentiality or integrity of the system (Red Hat Portal).

The vulnerability can be exploited by setting a large number of PBKDF2 iterations in the p2c parameter, which triggers uncontrolled resource consumption. A proof of concept exists demonstrating the exploitation by creating a JWE with an extremely large p2c value (CVE Request).

The vulnerability has been fixed in jose version 13. Users are advised to upgrade to this version or later. Updates have been released for various distributions including Fedora 38, 39, and 40 (Fedora Update).