Insufficient entropy in jose4j - CVE-2023-31582

Vulnerability identifier: #VU83977

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-31582

CWE-ID: CWE-331

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to brute-force JWT token.

The vulnerability exists due to usage of insufficient entropy when generating JWT token. A remote attacker can brute-force the JWT token and gain unauthorized access to the application.

jose4j
IBM Operations Analytics Predictive Insights
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Sterling B2B Integrator
Oracle Communications Cloud Native Core Network Repository Function
Oracle Communications Cloud Native Core Network Exposure Function
Netcool Operations Insight
Red Hat build of Quarkus
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
AMQ Streams
SUSE Manager Proxy
SUSE Manager Proxy Module
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Server Module
JBoss Data Grid
IBM Qradar SIEM
Oracle Communications Cloud Native Core Unified Data Repository
liberate-formula
saltboot-formula
inter-server-sync-debuginfo
inter-server-sync
jose4j
prometheus-formula
grafana-formula
prometheus-postgres_exporter
subscription-matcher
cobbler
mgr-daemon
uyuni-reportdb-schema
supportutils-plugin-susemanager
susemanager-sync-data
spacewalk-client-tools
python3-spacewalk-check
python3-spacewalk-client-setup
spacewalk-check
spacewalk-client-setup
python3-spacewalk-client-tools
spacewalk-utils
spacewalk-utils-extras
spacewalk-setup
python3-spacewalk-certs-tools
spacewalk-certs-tools
susemanager-schema-utility
susemanager-schema
spacecmd
spacewalk-backend-package-push-server
spacewalk-backend-iss-export
spacewalk-backend-server
spacewalk-backend-xml-export-libs
spacewalk-backend-sql-postgresql
spacewalk-backend-xmlrpc
spacewalk-backend-config-files-tool
spacewalk-backend-sql
spacewalk-backend-iss
spacewalk-backend-tools
spacewalk-backend-applet
spacewalk-backend
spacewalk-backend-config-files-common
spacewalk-backend-app
spacewalk-backend-config-files
susemanager
susemanager-tools
spacewalk-base-minimal-config
spacewalk-base-minimal
spacewalk-html
spacewalk-base
uyuni-config-modules
susemanager-sls
spacewalk-java-postgresql
spacewalk-taskomatic
spacewalk-java-config
spacewalk-java
spacewalk-java-lib
patterns-suma_server
patterns-suma_retail
patterns-suma_proxy
susemanager-docs_en-pdf
susemanager-docs_en
susemanager-build-keys-web
susemanager-build-keys
ObjectScale
Netezza Performance Server Replication Services
PowerStore T
Dell EMC PowerStore Family Operating System
HPE Unified OSS Console (UOC)

Install updates from vendor's website.

jose4j - update to 0.9.3
IBM Operations Analytics Predictive Insights - update to 1.3.6.8
AMQ Streams - update to 2.6.0
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.1, 5.1.2, 5.1.3
IBM Sterling B2B Integrator - addressed in versions 6.1.2.6, 6.2.0.3
JBoss Data Grid - update to 8.4.6
liberate-formula - update to 0.1.0-150400.10.3.3
saltboot-formula - update to 0.1.1701196218.b6b8ca1-150400.3.15.3
inter-server-sync-debuginfo - update to 0.3.2-150400.3.27.5
inter-server-sync - update to 0.3.2-150400.3.27.5
jose4j - update to 0.5.1-150400.3.6.2
prometheus-formula - update to 0.8.0-150400.3.6.5
grafana-formula - update to 0.10.0-150400.3.15.5
prometheus-postgres_exporter - update to 0.10.1-150400.3.9.5
subscription-matcher - update to 0.35-150400.3.19.5
ObjectScale - update to 1.4.0
Netcool Operations Insight - update to 1.6.12
Red Hat build of Quarkus - update to 2.13.9
Netezza Performance Server Replication Services - update to 3.0.5.0
HPE Unified OSS Console (UOC) - update to 3.1.0
cobbler - update to 3.3.3-150400.5.39.5
PowerStore T - update to 3.6.1.2-2315284
Dell EMC PowerStore Family Operating System - update to 4.0.0.0-2284811
mgr-daemon - update to 4.3.8-150400.3.12.5
uyuni-reportdb-schema - update to 4.3.9-150400.3.12.7
supportutils-plugin-susemanager - update to 4.3.10-150400.3.18.5
susemanager-sync-data - update to 4.3.16-150400.3.22.2
spacewalk-client-tools - update to 4.3.18-150400.3.24.7
python3-spacewalk-check - update to 4.3.18-150400.3.24.7
python3-spacewalk-client-setup - update to 4.3.18-150400.3.24.7
spacewalk-check - update to 4.3.18-150400.3.24.7
spacewalk-client-setup - update to 4.3.18-150400.3.24.7
python3-spacewalk-client-tools - update to 4.3.18-150400.3.24.7
spacewalk-utils - update to 4.3.19-150400.3.21.5
spacewalk-utils-extras - update to 4.3.19-150400.3.21.5
spacewalk-setup - update to 4.3.19-150400.3.30.5
python3-spacewalk-certs-tools - update to 4.3.22-150400.3.25.1
spacewalk-certs-tools - update to 4.3.22-150400.3.25.1
susemanager-schema-utility - update to 4.3.24-150400.3.36.7
susemanager-schema - update to 4.3.24-150400.3.36.7
spacecmd - update to 4.3.26-150400.3.33.5
spacewalk-backend-package-push-server - update to 4.3.27-150400.3.38.2
spacewalk-backend-iss-export - update to 4.3.27-150400.3.38.2
spacewalk-backend-server - update to 4.3.27-150400.3.38.2
spacewalk-backend-xml-export-libs - update to 4.3.27-150400.3.38.2
spacewalk-backend-sql-postgresql - update to 4.3.27-150400.3.38.2
spacewalk-backend-xmlrpc - update to 4.3.27-150400.3.38.2
spacewalk-backend-config-files-tool - update to 4.3.27-150400.3.38.2
spacewalk-backend-sql - update to 4.3.27-150400.3.38.2
spacewalk-backend-iss - update to 4.3.27-150400.3.38.2
spacewalk-backend-tools - update to 4.3.27-150400.3.38.2
spacewalk-backend-applet - update to 4.3.27-150400.3.38.2
spacewalk-backend - update to 4.3.27-150400.3.38.2
spacewalk-backend-config-files-common - update to 4.3.27-150400.3.38.2
spacewalk-backend-app - update to 4.3.27-150400.3.38.2
spacewalk-backend-config-files - update to 4.3.27-150400.3.38.2
susemanager - update to 4.3.34-150400.3.45.5
susemanager-tools - update to 4.3.34-150400.3.45.5
spacewalk-base-minimal-config - update to 4.3.37-150400.3.39.7
spacewalk-base-minimal - update to 4.3.37-150400.3.39.7
spacewalk-html - update to 4.3.37-150400.3.39.7
spacewalk-base - update to 4.3.37-150400.3.39.7
uyuni-config-modules - update to 4.3.40-150400.3.44.1
susemanager-sls - update to 4.3.40-150400.3.44.1
spacewalk-java-postgresql - update to 4.3.71-150400.3.74.2
spacewalk-taskomatic - update to 4.3.71-150400.3.74.2
spacewalk-java-config - update to 4.3.71-150400.3.74.2
spacewalk-java - update to 4.3.71-150400.3.74.2
spacewalk-java-lib - update to 4.3.71-150400.3.74.2
patterns-suma_server - update to 4.3-150400.5.9.5
patterns-suma_retail - update to 4.3-150400.5.9.5
patterns-suma_proxy - update to 4.3-150400.5.9.5
susemanager-docs_en-pdf - update to 4.3-150400.9.53.5
susemanager-docs_en - update to 4.3-150400.9.53.5
IBM Qradar SIEM - update to 7.5.0 Update Pack 8 IF01
susemanager-build-keys-web - update to 15.4.10-150400.3.23.5
susemanager-build-keys - update to 15.4.10-150400.3.23.5
IBM Business Automation Workflow - addressed in versions 21.0.3 IF029, 23.0.2
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.29, 23.0.2.1

• https://bitbucket.org/b_c/jose4j/issues/203/insecure-support-of-setting-pbe-less-then
• https://github.com/KANIXB/JWTIssues/blob/main/jose4j%20issue.md

• Insufficient entropy in jose4j
• Multiple vulnerabilities in Red Hat AMQ Streams
• Multiple vulnerabilities in Red Hat build of Quarkus 2.13
• Multiple vulnerabilities in Red Hat Data Grid 8.4
• Multiple vulnerabilities in HPE Unified OSS Console Assurance Monitoring (UOCAM)
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Exposure Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Insufficient entropy in IBM Business Automation Workflow
• SUSE update for Maintenance update for SUSE Manager 4.3: Server, Proxy and Retail Branch Server
• Multiple vulnerabilities in IBM Operations Analytics Predictive Insights
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Dell PowerStore Family
• Multiple vulnerabilities in Dell PowerStoreT OS
• Multiple vulnerabilities in Dell ObjectScale
• IBM Sterling B2B Integrator update for WebSphere Application Server
• Multiple vulnerabilities in IBM Watson Knowledge Catalog
• Multiple vulnerabilities in IBM Netezza Performance Server Replication Services