CVE-2023-50967
📋 TL;DR
CVE-2023-50967 is a denial-of-service vulnerability in latchset jose library versions through 11. Attackers can cause excessive CPU consumption by providing a large p2c (PBES2 Count) value in cryptographic operations. This affects any application using vulnerable versions of the jose library for JSON Object Signing and Encryption.
💻 Affected Systems
- latchset jose
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Jose by Latchset
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion, potentially affecting multiple services if the library is widely used in an application stack.
Likely Case
Degraded performance or temporary service disruption for applications processing malicious JOSE tokens with large p2c values.
If Mitigated
Minimal impact with proper input validation and resource limits in place.
🎯 Exploit Status
Exploitation is straightforward - simply send a JWE token with an extremely large p2c value to trigger CPU-intensive PBKDF2 operations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 12 or later
Vendor Advisory: https://github.com/latchset/jose
Restart Required: No
Instructions:
1. Update jose library to version 12 or later. 2. For package managers: 'pip install jose>=12' or equivalent. 3. Rebuild and redeploy applications using the updated library.
🔧 Temporary Workarounds
Input validation for p2c parameter
allImplement validation to reject JWE tokens with p2c values above a reasonable threshold (e.g., 10000).
Resource limiting
allImplement CPU time limits or request timeouts for JOSE token processing operations.
🧯 If You Can't Patch
- Implement strict input validation to reject JWE tokens with p2c values exceeding safe limits
- Deploy rate limiting and monitoring for JOSE token processing endpoints
🔍 How to Verify
Check if Vulnerable:
Check jose library version in your application dependencies. If version <= 11 and application processes JWE tokens, it is vulnerable.Check Version:
python -c "import jose; print(jose.__version__)" or check package manager (pip list | grep jose)Verify Fix Applied:
Verify jose library version is >= 12. Test with sample JWE tokens containing various p2c values to ensure proper validation.📡 Detection & Monitoring
Log Indicators:
- Unusually high CPU usage during JOSE/JWE processing
- Requests timing out during token validation
- Multiple failed authentication attempts with malformed tokens
Network Indicators:
- High volume of requests to JOSE/JWE endpoints
- Requests with unusually large payloads to authentication endpoints
SIEM Query:
source=application_logs ("jose" OR "JWE" OR "p2c") AND (cpu_usage>90 OR duration>5s)🔗 References
- https://github.com/P3ngu1nW/CVE_Request/blob/main/latch-jose.md
- https://github.com/latchset/jose
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CIFPQUCLNWEAHYYJWCQD3AZPWYIV6YT3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OOBFVMOAV732C7PY74AHJ62ZNKT3ISZ6/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W7EGLOAFN2PWZ75ZRLTUDUZCIPH2VFZU/
- https://github.com/P3ngu1nW/CVE_Request/blob/main/latch-jose.md
- https://github.com/latchset/jose
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CIFPQUCLNWEAHYYJWCQD3AZPWYIV6YT3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OOBFVMOAV732C7PY74AHJ62ZNKT3ISZ6/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W7EGLOAFN2PWZ75ZRLTUDUZCIPH2VFZU/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CIFPQUCLNWEAHYYJWCQD3AZPWYIV6YT3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OOBFVMOAV732C7PY74AHJ62ZNKT3ISZ6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W7EGLOAFN2PWZ75ZRLTUDUZCIPH2VFZU/
