CVE-2023-51775: 
Java vulnerability analysis and mitigation

The jose4j component before version 0.9.4 for Java contains a vulnerability (CVE-2023-51775) that allows attackers to cause a denial of service through CPU consumption. The vulnerability was discovered on December 3, 2023, and affects the PBKDF2-based JWE key management algorithms. The issue stems from the ability to manipulate the p2c (PBES2 Count) parameter with a large value (Bitbucket Issue, NVD).

The vulnerability exists in the JWE key management algorithms based on PBKDF2, which require a JOSE Header Parameter called p2c (PBES2 Count). This parameter controls the number of PBKDF2 iterations needed to derive a CEK wrapping key. While the parameter is designed to intentionally slow down key derivation for security purposes, there was no upper limit on the iteration count, allowing attackers to set extremely large values that could cause excessive CPU consumption (Bitbucket Issue).

When exploited, this vulnerability can lead to denial of service through excessive CPU consumption. The attack affects systems processing JWE tokens with PBES2-based algorithms, potentially causing significant performance degradation or service unavailability (Red Hat CVE).

The vulnerability is exploitable by crafting a JWE token with a very large p2c parameter value. A proof of concept was provided demonstrating how an attacker could create a malicious JWE token that would trigger excessive computational consumption (Bitbucket Issue).

The vulnerability was fixed in jose4j version 0.9.4. The fix includes adding PBES2 algorithms to JWE's default blocked AlgorithmConstraints and implementing a maximum limit on the iteration count. For users unable to upgrade immediately, implementing custom AlgorithmConstraints to block PBES2 algorithms can serve as a workaround (Bitbucket Issue).