Input validation error in jwcrypto - CVE-2023-6681

Vulnerability identifier: #VU84778

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-6681

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of the p2c header. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

jwcrypto
SOAR QRadar Plugin App
QRadar Suite
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
openEuler
python3-jwcrypto
ipa-healthcheck-core
python3-pyusb
python3-yubico
python-jwcrypto
python-jwcrypto (Red Hat package)
ipa-python-compat
python3-ipalib
python3-ipaclient
ipa-selinux
ipa-common
ipa-client-common
ipa-client-samba
ipa-client-epn
ipa-client
python3-qrcode
python3-qrcode-core

Install updates from vendor's website.

jwcrypto - update to 1.5.1
QRadar Suite - update to 1.10.18.0
python3-jwcrypto - update to 0.5.0-2
ipa-healthcheck-core - update to 0.12-3
python3-pyusb - update to 1.0.0-9.1
python3-yubico - update to 1.3.2-9.1
python-jwcrypto - update to 1.4.2-2
python3-jwcrypto - update to 1.4.2-2
python-jwcrypto (Red Hat package) - update to 1.5.6-2.el9
ipa-python-compat - update to 4.9.13-9.0.1
python3-ipalib - update to 4.9.13-9.0.1
python3-ipaclient - update to 4.9.13-9.0.1
ipa-selinux - update to 4.9.13-9.0.1
ipa-common - update to 4.9.13-9.0.1
ipa-client-common - update to 4.9.13-9.0.1
ipa-client-samba - update to 4.9.13-9.0.1
ipa-client-epn - update to 4.9.13-9.0.1
ipa-client - update to 4.9.13-9.0.1
python3-qrcode - update to 5.1-12
python3-qrcode-core - update to 5.1-12
SOAR QRadar Plugin App - update to 5.4.0

• https://github.com/latchset/jwcrypto/releases/tag/v1.5.1
• https://github.com/latchset/jwcrypto/pull/336
• https://github.com/latchset/jwcrypto/security/advisories/GHSA-cw2r-4p82-qv79

• Denial of service in jwcrypto
• Multiple vulnerabilities in IBM QRadar Suite Software
• openEuler 22.03 LTS SP1 update for python-jwcrypto
• openEuler 22.03 LTS SP2 update for python-jwcrypto
• openEuler 22.03 LTS SP3 update for python-jwcrypto
• Multiple vulnerabilities in IBM SOAR QRadar Plugin App
• Red Hat Enterprise Linux 8 update for the idm:DL1 and idm:client modules
• Red Hat Enterprise Linux 9 update for python-jwcrypto
• Anolis OS update for idm:client module