Resource exhaustion in Nimbus JOSE+JWT - CVE-2023-52428

Vulnerability identifier: #VU87615

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-52428

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper validation of user requests by the PasswordBasedDecrypter (PBKDF2) component. A remote attacker can send a specially crafted request using a large JWE p2c header, trigger resource exhaustion and perform a denial of service (DoS) attack.

Nimbus JOSE+JWT
IBM Observability with Instana
Crucible Data Center
Crucible Server
IBM Watson Knowledge Catalog in Cloud Pak for Data
Jira Service Management Data Center
Jira Service Management Server
Crowd Data Center
Confluence Data Center
Bamboo Server
Splunk AppDynamics Database Agent
IBM Cloud Pak for Security
IBM Sterling Connect:Direct for UNIX
UCD - IBM UrbanCode Deploy
Bitbucket Data Center
Oracle Utilities Application Framework
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
DataStage on Cloud Pak for Data
Oracle Business Intelligence Enterprise Edition
Maximo Application Suite - Visual Inspection Component
IBM Engineering Requirements Management DOORS Next
webMethods Managed File Transfer
Dell Data Protection Central
Business Automation Insights
IBM Application Suite - IBM Asset Data Dictionary Component
Cloud Pak for Network Automation
User Entity Behavior Analytics
Cognos Dashboards on Cloud Pak for Data
IBM Sterling Connect:Direct for Microsoft Windows
IBM Engineering Lifecycle Optimization - Publishing
DevOps Deploy
Crowd Server
Confluence Server
JBoss Enterprise Application Platform
Oracle WebLogic Server
AMQ Streams
Bitbucket Server
PeopleSoft Enterprise PeopleTools
Planning Analytics Local
IBM Cognos Analytics
Primavera Unifier
Oracle Database Server
IBM InfoSphere Information Server
eap8-asyncutil (Red Hat package)
eap8-hppc (Red Hat package)
eap8-jboss-cert-helper (Red Hat package)
eap8-insights-java-client (Red Hat package)
eap8-cryptacular (Red Hat package)
eap8-aesh-extensions (Red Hat package)
eap8-aws-java-sdk (Red Hat package)
eap8-apache-commons-codec (Red Hat package)
eap8-artemis-native (Red Hat package)
eap8-activemq-artemis-native (Red Hat package)
eap8-artemis-wildfly-integration (Red Hat package)
eap8-resteasy-extensions (Red Hat package)
eap8-slf4j (Red Hat package)
eap8-fastinfoset (Red Hat package)
eap8-snakeyaml (Red Hat package)
eap8-aesh-readline (Red Hat package)
eap8-pem-keystore (Red Hat package)
eap8-apache-commons-io (Red Hat package)
eap8-log4j (Red Hat package)
eap8-activemq-artemis (Red Hat package)
eap8-jakarta-servlet-jsp-jstl-api (Red Hat package)
eap8-resteasy-spring (Red Hat package)
eap8-saaj-impl (Red Hat package)
eap8-apache-commons-collections (Red Hat package)
eap8-jboss-logging (Red Hat package)
eap8-apache-commons-lang (Red Hat package)
eap8-jctools (Red Hat package)
eap8-apache-cxf (Red Hat package)
eap8-jgroups (Red Hat package)
eap8-narayana (Red Hat package)
eap8-hibernate (Red Hat package)
eap8-shibboleth-java-support (Red Hat package)
eap8-hibernate-validator (Red Hat package)
eap8-wildfly (Red Hat package)
eap8-objectweb-asm (Red Hat package)
eap8-nimbus-jose-jwt (Red Hat package)
eap8-eap-product-conf-parent (Red Hat package)
Red Hat Camel for Spring Boot
RSA Authentication Manager
Event Streams

Install updates from vendor's website.

Nimbus JOSE+JWT - update to 9.37.2
IBM Observability with Instana - update to 1.0.297
Crucible Data Center - update to 4.9.8
Crucible Server - update to 4.9.8
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2.1
DataStage on Cloud Pak for Data - update to 5.0.0
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.3
Jira Service Management Data Center - addressed in versions 5.4.19, 5.12.6
Jira Service Management Server - addressed in versions 5.4.19, 5.12.6
Crowd Server - update to 6.2.3
Crowd Data Center - update to 6.2.3
Confluence Data Center - addressed in versions 7.19.23, 8.5.11, 8.6.2, 8.7.2, 8.9.3
Confluence Server - addressed in versions 7.19.23, 8.5.11, 8.6.2, 8.7.2, 8.9.3
JBoss Enterprise Application Platform - update to 8.0.4
Maximo Application Suite - Visual Inspection Component - update to 8.9.20
Bamboo Server - addressed in versions 9.2.15, 9.4.3, 9.5.3, 9.6.3
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.11
Dell Data Protection Central - update to 19.12.0-2
Oracle Database Server - update to 23.7
Business Automation Insights - addressed in versions 24.0.0.0.4, 24.0.1.0.4
Splunk AppDynamics Database Agent - update to 26.1.0
eap8-asyncutil (Red Hat package) - addressed in versions 0.1.0-2.redhat_00010.1.el8eap, 0.1.0-2.redhat_00010.1.el9eap
eap8-hppc (Red Hat package) - addressed in versions 0.8.1-2.redhat_00001.1.el8eap, 0.8.1-2.redhat_00001.1.el9eap
eap8-jboss-cert-helper (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
eap8-insights-java-client (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.15
eap8-cryptacular (Red Hat package) - addressed in versions 1.2.5-2.redhat_00001.1.el8eap, 1.2.5-2.redhat_00001.1.el9eap
eap8-aesh-extensions (Red Hat package) - addressed in versions 1.8.0-2.redhat_00001.1.el8eap, 1.8.0-2.redhat_00001.1.el9eap
IBM Cloud Pak for Security - update to 1.11.2.0
eap8-aws-java-sdk (Red Hat package) - addressed in versions 1.12.284-2.redhat_00002.1.el8eap, 1.12.284-2.redhat_00002.1.el9eap
eap8-apache-commons-codec (Red Hat package) - addressed in versions 1.16.1-2.redhat_00007.1.el8eap, 1.16.1-2.redhat_00007.1.el9eap
AMQ Streams - addressed in versions 2, 2.5.2, 2.7.0
eap8-artemis-native (Red Hat package) - addressed in versions 2.0.0-2.redhat_00005.1.el8eap, 2.0.0-2.redhat_00005.1.el9eap
eap8-activemq-artemis-native (Red Hat package) - addressed in versions 2.0.0-2.redhat_00005.1.el8eap, 2.0.0-2.redhat_00005.1.el9eap
Planning Analytics Local - addressed in versions 2.0.0.96, 2.1.3
eap8-artemis-wildfly-integration (Red Hat package) - addressed in versions 2.0.1-1.redhat_00002.1.el8eap, 2.0.1-1.redhat_00002.1.el9eap
eap8-resteasy-extensions (Red Hat package) - addressed in versions 2.0.1-3.Final_redhat_00001.1.el8eap, 2.0.1-3.Final_redhat_00001.1.el9eap
eap8-slf4j (Red Hat package) - addressed in versions 2.0.16-1.redhat_00001.1.el8eap, 2.0.16-1.redhat_00001.1.el9eap
eap8-fastinfoset (Red Hat package) - addressed in versions 2.1.0-4.redhat_00001.1.el8eap, 2.1.0-4.redhat_00001.1.el9eap
eap8-snakeyaml (Red Hat package) - addressed in versions 2.2.0-1.redhat_00001.1.el8eap, 2.2.0-1.redhat_00001.1.el9eap
eap8-aesh-readline (Red Hat package) - addressed in versions 2.2.0-2.redhat_00001.1.el8eap, 2.2.0-2.redhat_00001.1.el9eap
eap8-pem-keystore (Red Hat package) - addressed in versions 2.3.0-1.redhat_00001.1.el8eap, 2.3.0-1.redhat_00001.1.el9eap
Cloud Pak for Network Automation - update to 2.7.5
eap8-apache-commons-io (Red Hat package) - addressed in versions 2.15.1-1.redhat_00001.1.el8eap, 2.15.1-1.redhat_00001.1.el9eap
eap8-log4j (Red Hat package) - addressed in versions 2.22.1-1.redhat_00002.1.el8eap, 2.22.1-1.redhat_00002.1.el9eap
eap8-activemq-artemis (Red Hat package) - addressed in versions 2.33.0-1.redhat_00015.1.el8eap, 2.33.0-1.redhat_00015.1.el9eap
eap8-jakarta-servlet-jsp-jstl-api (Red Hat package) - addressed in versions 3.0.1-1.redhat_00001.1.el8eap, 3.0.1-1.redhat_00001.1.el9eap
eap8-resteasy-spring (Red Hat package) - addressed in versions 3.0.1-2.Final_redhat_00001.1.el8eap, 3.0.1-2.Final_redhat_00001.1.el9eap
eap8-saaj-impl (Red Hat package) - addressed in versions 3.0.4-1.redhat_00001.1.el8eap, 3.0.4-1.redhat_00001.1.el9eap
eap8-apache-commons-collections (Red Hat package) - addressed in versions 3.2.2-28.redhat_2.1.el8eap, 3.2.2-28.redhat_2.1.el9eap
eap8-jboss-logging (Red Hat package) - addressed in versions 3.5.3-1.Final_redhat_00001.1.el8eap, 3.5.3-1.Final_redhat_00001.1.el9eap
eap8-apache-commons-lang (Red Hat package) - addressed in versions 3.14.0-2.redhat_00006.1.el8eap, 3.14.0-2.redhat_00006.1.el9eap
Red Hat Camel for Spring Boot - addressed in versions 3.20.7, 4.4.3
eap8-jctools (Red Hat package) - addressed in versions 4.0.2-1.redhat_00001.1.el8eap, 4.0.2-1.redhat_00001.1.el9eap
eap8-apache-cxf (Red Hat package) - addressed in versions 4.0.5-1.redhat_00001.1.el8eap, 4.0.5-1.redhat_00001.1.el9eap
User Entity Behavior Analytics - update to 5.0.2
Cognos Dashboards on Cloud Pak for Data - update to 5.1
eap8-jgroups (Red Hat package) - addressed in versions 5.3.10-1.Final_redhat_00001.1.el8eap, 5.3.10-1.Final_redhat_00001.1.el9eap
eap8-narayana (Red Hat package) - addressed in versions 6.0.3-1.Final_redhat_00001.1.el8eap, 6.0.3-1.Final_redhat_00001.1.el9eap
IBM Sterling Connect:Direct for Microsoft Windows - addressed in versions 6.2.0.6.12, 6.3.0.2.12
IBM Sterling Connect:Direct for UNIX - addressed in versions 6.2.0.7.15, 6.3.0.2.21
eap8-hibernate (Red Hat package) - addressed in versions 6.2.31-1.Final_redhat_00002.1.el8eap, 6.2.31-1.Final_redhat_00002.1.el9eap
IBM Engineering Lifecycle Optimization - Publishing - addressed in versions 7.0.2.35, 7.0.3.16
UCD - IBM UrbanCode Deploy - addressed in versions 7.1.2.18, 7.2.3.11, 7.3.2.6
eap8-shibboleth-java-support (Red Hat package) - addressed in versions 8.0.0-6.redhat_00001.1.el8eap, 8.0.0-6.redhat_00001.1.el9eap
DevOps Deploy - update to 8.0.1.1
eap8-hibernate-validator (Red Hat package) - addressed in versions 8.0.1-3.Final_redhat_00001.1.el8eap, 8.0.1-3.Final_redhat_00001.1.el9eap
eap8-wildfly (Red Hat package) - addressed in versions 8.0.4-2.GA_redhat_00005.1.el8eap, 8.0.4-2.GA_redhat_00005.1.el9eap
RSA Authentication Manager - update to 8.7 SP2 Patch 2
Bitbucket Data Center - update to 8.19.25
Bitbucket Server - update to 8.19.25
eap8-objectweb-asm (Red Hat package) - addressed in versions 9.6.0-1.redhat_00002.1.el8eap, 9.6.0-1.redhat_00002.1.el9eap
eap8-nimbus-jose-jwt (Red Hat package) - addressed in versions 9.37.3-1.redhat_00001.1.el8eap, 9.37.3-1.redhat_00001.1.el9eap
IBM Cognos Analytics - addressed in versions 11.2.4 FP4, 12.0.4
Event Streams - update to 11.6.1
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 5
eap8-eap-product-conf-parent (Red Hat package) - addressed in versions 800.4.0-1.GA_redhat_00001.1.el8eap, 800.4.0-1.GA_redhat_00001.1.el9eap

• https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/526/
• https://connect2id.com/products/nimbus-jose-jwt
• https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e

• Resource exhaustion in IBM Sterling Connect:Direct for Microsoft Windows
• Resource exhaustion in IBM Sterling Connect:Direct for UNIX
• Multiple vulnerabilities in Primavera Unifier
• Multiple vulnerabilities in Oracle WebLogic Server
• Jira Service Management Data Center and Server update for Nimbus JOSE+JWT
• Resource exhaustion in IBM DevOps Deploy / IBM UrbanCode Deploy (UCD)
• Multiple vulnerabilities in AMQ Streams 2.7
• Multiple vulnerabilities in IBM Planning Analytics Local - IBM Planning Analytics Workspace
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in Oracle Utilities Application Framework
• Resource exhaustion in IBM InfoSphere Information Server
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in AMQ Streams 2.5
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 3.20
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 4.4
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
• Multiple vulnerabilities in IBM Cognos Analytics
• Confluence Data Center and Server update for nimbus-jose-jwt
• Bamboo Data Center and Server update for Nimbus JOSE+JWT
• Multiple vulnerabilities in Oracle Database Server
• Multiple vulnerabilities in IBM Asset Data Dictionary Component
• Multiple vulnerabilities in IBM Event Streams
• IBM DataStage on Cloud Pak for Data update for Connect2id Nimbus-JOSE-JWT
• Multiple vulnerabilities in AMQ Streams
• Crowd Data Center and Server update for nimbus-jose-jwt
• Multiple vulnerabilities in IBM Cognos Dashboards on Cloud Pak for Data
• Dell Data Protection Central update for third-party component
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Multiple vulnerabilities in IBM webMethods Managed File Transfer
• RSA Authentication Manager update for third-party components
• Multiple vulnerabilities in IBM Knowledge Catalog for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• IBM Engineering Lifecycle Optimization - Publishing update for Connect2id Nimbus JOSE+JWT
• Multiple vulnerabilities in IBM Business Automation Insights
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for Connect2id Nimbus JOSE+JWT
• Multiple vulnerabilities in IBM User Entity Behavior Analytics
• Bitbucket Data Center and Server update for Nimbus JOSE+JWT
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS and DOORS Web Access
• Multiple vulnerabilities in IBM Maximo Application Suite - Visual Inspection Component
• Splunk AppDynamics Database Agent update for third-party components
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Crucible Data Center and Server update for nimbus-jose-jwt