CVE-2025-45767:
Linux Debian vulnerability analysis and mitigation

Overview

The jose library version 6.0.10 was discovered to contain weak encryption vulnerability (CVE-2025-45767). The vulnerability was disclosed on August 1, 2025, affecting the jose library's cryptographic implementation. The issue specifically impacts the HMAC and RSA key lengths used in the JSON Web Signature (JWS) implementation which do not meet recommended security standards according to RFC 7518, NIST SP800-117, and RFC 2437 (GitHub Gist).

Technical details

The vulnerability is classified under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) with a CVSS v3.1 base score of 7.0 HIGH (Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H). The issue stems from inadequate encryption strength where the key lengths used in the implementation are too short, not meeting the security standards specified in multiple RFCs and NIST guidelines (NVD).

Impact

The use of weak encryption keys can lead to serious vulnerabilities and potential attacks. This vulnerability affects the confidentiality and integrity of data protected by the jose library's cryptographic functions, potentially exposing sensitive information to unauthorized access (GitHub Gist).

Mitigation and workarounds

Users of the affected versions should upgrade to a patched version of the library that implements proper key lengths meeting the current security standards. The issue has been addressed in subsequent releases (GitHub Gist).