En bref
- CVE-2021-29443 est une vulnérabilité MOYENNE (CVSS 5.9) touchant jose (panva), jose.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.2%, plus élevée que 67.5% des vulnérabilités.
- Correctif : mettre à jour vers 1.28.1, 2.0.5, 3.11.4 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| jose | ≥ 1.0.0, < 1.28.1≥ 2.0.0, < 2.0.5≥ 3.0.0, < 3.11.4
| 1.28.12.0.53.11.4
|
| jose npm | ≥ 1.0.0, < 1.28.1≥ 2.0.0, < 2.0.5≥ 3.0.0, < 3.11.4
| 1.28.12.0.53.11.4
|
Description
jose is an npm library providing a number of cryptographic operations.
Impact
AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed JWEDecryptionFailed would be thrown. But a possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block).
Patches
All major release versions have had a patch released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are ^1.28.1 || ^2.0.5 || >=3.11.4.
Users should upgrade their v1.x dependency to ^1.28.1, their v2.x dependency to ^2.0.5, and their v3.x dependency to ^3.11.4
Credits
Thanks to Morgan Brown of Microsoft for bringing this up and Eva Sarafianou (@esarafianou) for helping to score this advisory.
NVD description
jose is an npm library providing a number of cryptographic operations. In vulnerable versions AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. A possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). All major release versions have had a patch released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `^1.28.1 || ^2.0.5 || >=3.11.4`. Users should upgrade their v1.x dependency to ^1.28.1, their v2.x dependency to ^2.0.5, and their v3.x dependency to ^3.11.4. Thanks to Jason from Microsoft Vulnerability Research (MSVR) for bringing this up and Eva Sarafianou (@esarafianou) for helping to score this advisory.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free