Resource exhaustion in jose4j - CVE-2023-51775

 

Resource exhaustion in jose4j - CVE-2023-51775

Published: April 5, 2024


Vulnerability identifier: #VU88173
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-51775
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion via large p2c (aka PBES2 Count) value and perform a denial of service (DoS) attack.


Affected software

jose4j
Engineering Workflow Management
IBM Business Automation Workflow
IBM Tivoli Netcool/OMNIbus WebGUI
IBM Rational ClearQuest
IBM Rational ClearCase
IBM Intelligent Operations Center
IBM Operations Analytics Predictive Insights
IBM MQ Operator
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM SPSS Analytic Server
IBM Tivoli System Automation Application Manager
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Sterling B2B Integrator
IBM Tivoli Netcool Impact
IBM Maximo Asset Management
WebSphere Service Registry and Repository
WebSphere Remote Server
IBM Security Verify Governance
InfoSphere Master Data Management
Oracle Middleware Common Libraries and Tools
Oracle Communications Cloud Native Core Automated Test Suite
Oracle Communications Network Analytics Data Director
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Repository Function
Oracle Communications EAGLE Element Management System
Jazz for Service Management
Log Analysis
IBM Cloud Pak for Security
IBM Process Mining
Unified OSS Console Assurance Monitoring (UOCAM)
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Match 360
IBM Spectrum Control
IBM Tivoli Monitoring
IBM Cloud Application Performance Management (APM)
IBM SPSS Collaboration and Deployment Services
IBM Maximo Application Suite - Manage Component
IBM Maximo Application Suite
IBM TXSeries for Multiplatforms
IBM MQ
IBM Cloud Pak for Business Automation
IBM Observability with Instana
Jazz Foundation
IBM CICS TX Advanced
IBM CICS TX Standard
IBM Engineering Requirements Management DOORS Next
Engineering Test Management
Intelligent Operations Center for Emergency Management
Tivoli Composite Application Manager for Application Diagnostics
IBM OpenPages with Watson
Business Monitor
Maximo Application Suite - Visual Inspection Component
IBM Security Verify Information Queue
DevOps
IBM Application Suite - IBM Asset Data Dictionary Component
PowerVM NovaLink
IBM Planning Analytics Workspace
Netezza Performance Server Replication Services
Storage Protect Operations Center
Maximo Application Suite - Monitor Component
Maximo Application Suite - Predict Component
Telco Service Activator
Robotic Process Automation for Cloud Pak
Business Automation Insights
IBM Content Navigator
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Server Module
SUSE Manager Retail Branch Server
SUSE Manager Proxy Module
openSUSE Leap
IBM Tivoli Application Dependency Discovery Manager
Oracle WebCenter Sites
JBoss Enterprise Application Platform
IBM WebSphere Application Server Liberty
AMQ Streams
IBM WebSphere Application Server
IBM Cognos Controller
Financial Transaction Manager
IBM Qradar SIEM
IBM License Metric Tool
Event Streams
Oracle Communications Cloud Native Core Unified Data Repository
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Service Communication Proxy
image-sync-formula
inter-server-sync-debuginfo
inter-server-sync
jose4j
subscription-matcher
eap7-insights-java-client (Red Hat package)
eap7-jboss-cert-helper (Red Hat package)
eap7-ironjacamar (Red Hat package)
smdba
eap7-jboss-server-migration (Red Hat package)
eap7-jsoup (Red Hat package)
eap7-undertow-jastow (Red Hat package)
eap7-xalan-j2 (Red Hat package)
cobbler
eap7-hal-console (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
mgr-daemon
uyuni-reportdb-schema
python3-uyuni-common-libs
supportutils-plugin-susemanager
release-notes-susemanager-proxy
release-notes-susemanager
spacewalk-config
susemanager-sync-data
spacewalk-client-setup
spacewalk-check
python3-spacewalk-check
spacewalk-client-tools
python3-spacewalk-client-setup
python3-spacewalk-client-tools
spacewalk-certs-tools
python3-spacewalk-certs-tools
susemanager-schema
susemanager-schema-utility
spacecmd
spacewalk-backend-xml-export-libs
spacewalk-backend
spacewalk-backend-package-push-server
spacewalk-backend-iss-export
spacewalk-backend-xmlrpc
spacewalk-backend-sql
spacewalk-backend-iss
spacewalk-backend-server
spacewalk-backend-config-files-common
spacewalk-backend-tools
spacewalk-backend-config-files-tool
spacewalk-backend-sql-postgresql
spacewalk-backend-app
spacewalk-backend-config-files
spacewalk-backend-applet
susemanager-tools
susemanager
spacewalk-base-minimal
spacewalk-base
spacewalk-html
spacewalk-base-minimal-config
uyuni-config-modules
susemanager-sls
spacewalk-java-lib
spacewalk-taskomatic
spacewalk-java-postgresql
spacewalk-java-config
spacewalk-java
susemanager-docs_en-pdf
susemanager-docs_en
eap7-jbossws-cxf (Red Hat package)
eap7-hibernate-validator (Red Hat package)
eap7-wildfly (Red Hat package)
Red Hat OpenShift Serverless
Planning Analytics Local
Operational Decision Manager
IBM Cognos Analytics
IBM Cloud Pak for Multicloud Management
IBM Cloud Pak System
IBM InfoSphere Information Server

How to mitigate CVE-2023-51775

Install updates from vendor's website.

jose4j - update to 0.9.4
IBM MQ Operator - addressed in versions 9.3.0.20-r1, 9.4.0.0-r2
IBM Content Navigator - addressed in versions 3.0.15 IF009, 3.1.0 IF008 LA2, 3.2.0 IF004
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.1, 5.1.2, 5.1.3
IBM Sterling B2B Integrator - addressed in versions 6.1.2.6, 6.2.0.3
IBM Tivoli Netcool Impact - update to 7.1.0.34
JBoss Enterprise Application Platform - update to 7.4.19
Maximo Application Suite - Visual Inspection Component - update to 9.0.3
IBM Security Verify Information Queue - update to 10.0.9
IBM Cognos Controller - update to 11.0.1.0.3
IBM WebSphere Application Server Liberty - update to 24.0.0.4
image-sync-formula - update to 0.1.1711646883.4a44375-150400.3.18.4
inter-server-sync-debuginfo - update to 0.3.3-150400.3.30.4
inter-server-sync - update to 0.3.3-150400.3.30.4
jose4j - update to 0.5.1-150400.3.9.4
subscription-matcher - update to 0.37-150400.3.22.4
eap7-insights-java-client (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el7eap, 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
eap7-jboss-cert-helper (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el7eap, 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
Jazz for Service Management - update to 1.1.3.21
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.8
Log Analysis - update to 1.3.8
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.18-1.Final_redhat_00001.1.el7eap, 1.5.18-1.Final_redhat_00001.1.el8eap, 1.5.18-1.Final_redhat_00001.1.el9eap
smdba - update to 1.7.13-0.150400.4.12.4
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-39.Final_redhat_00039.1.el7eap, 1.10.0-39.Final_redhat_00039.1.el8eap, 1.10.0-39.Final_redhat_00039.1.el9eap
IBM Cloud Pak for Security - update to 1.11.2.0
IBM Process Mining - update to 1.15.0 IF004
eap7-jsoup (Red Hat package) - addressed in versions 1.15.4-1.redhat_00003.1.el7eap, 1.15.4-1.redhat_00003.1.el8eap, 1.15.4-1.redhat_00003.1.el9eap
Red Hat OpenShift Serverless - update to 1.33.0
PowerVM NovaLink - addressed in versions 2.0.3.1-240625, 2.1.1-240625, 2.2.1-240626
Planning Analytics Local - update to 2.0.9.20
eap7-undertow-jastow (Red Hat package) - addressed in versions 2.0.15-1.Final_redhat_00001.1.el7eap, 2.0.15-1.Final_redhat_00001.1.el8eap, 2.0.15-1.Final_redhat_00001.1.el9eap
IBM Planning Analytics Workspace - update to 2.1.4
IBM Cloud Pak for Multicloud Management - update to 2.3 Fix Pack 12
IBM Cloud Pak System - addressed in versions 2.3.4.1, 2.3.5.0
AMQ Streams - update to 2.5.2
eap7-xalan-j2 (Red Hat package) - addressed in versions 2.7.1-37.redhat_00015.1.el7eap, 2.7.1-37.redhat_00015.1.el8eap, 2.7.1-37.redhat_00015.1.el9eap
Netezza Performance Server Replication Services - update to 3.0.5.0
Unified OSS Console Assurance Monitoring (UOCAM) - update to 3.1.4
cobbler - update to 3.3.3-150400.5.42.5
eap7-hal-console (Red Hat package) - addressed in versions 3.3.24-1.Final_redhat_00001.1.el7eap, 3.3.24-1.Final_redhat_00001.1.el8eap, 3.3.24-1.Final_redhat_00001.1.el9eap
Financial Transaction Manager - update to 4.0.6.0 iFix4
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.55-1.Final_redhat_00001.1.el7eap, 4.0.55-1.Final_redhat_00001.1.el8eap, 4.0.55-1.Final_redhat_00001.1.el9eap
mgr-daemon - update to 4.3.9-150400.3.15.5
uyuni-reportdb-schema - update to 4.3.10-150400.3.15.6
python3-uyuni-common-libs - update to 4.3.10-150400.3.18.4
supportutils-plugin-susemanager - update to 4.3.11-150400.3.21.4
release-notes-susemanager-proxy - update to 4.3.12-150400.3.82.3
release-notes-susemanager - update to 4.3.12-150400.3.108.2
spacewalk-config - update to 4.3.13-150400.3.15.5
susemanager-sync-data - update to 4.3.17-150400.3.25.4
spacewalk-client-setup - update to 4.3.19-150400.3.27.5
spacewalk-check - update to 4.3.19-150400.3.27.5
python3-spacewalk-check - update to 4.3.19-150400.3.27.5
spacewalk-client-tools - update to 4.3.19-150400.3.27.5
python3-spacewalk-client-setup - update to 4.3.19-150400.3.27.5
python3-spacewalk-client-tools - update to 4.3.19-150400.3.27.5
spacewalk-certs-tools - update to 4.3.23-150400.3.28.5
python3-spacewalk-certs-tools - update to 4.3.23-150400.3.28.5
susemanager-schema - update to 4.3.25-150400.3.39.5
susemanager-schema-utility - update to 4.3.25-150400.3.39.5
spacecmd - update to 4.3.27-150400.3.36.5
spacewalk-backend-xml-export-libs - update to 4.3.28-150400.3.41.7
spacewalk-backend - update to 4.3.28-150400.3.41.7
spacewalk-backend-package-push-server - update to 4.3.28-150400.3.41.7
spacewalk-backend-iss-export - update to 4.3.28-150400.3.41.7
spacewalk-backend-xmlrpc - update to 4.3.28-150400.3.41.7
spacewalk-backend-sql - update to 4.3.28-150400.3.41.7
spacewalk-backend-iss - update to 4.3.28-150400.3.41.7
spacewalk-backend-server - update to 4.3.28-150400.3.41.7
spacewalk-backend-config-files-common - update to 4.3.28-150400.3.41.7
spacewalk-backend-tools - update to 4.3.28-150400.3.41.7
spacewalk-backend-config-files-tool - update to 4.3.28-150400.3.41.7
spacewalk-backend-sql-postgresql - update to 4.3.28-150400.3.41.7
spacewalk-backend-app - update to 4.3.28-150400.3.41.7
spacewalk-backend-config-files - update to 4.3.28-150400.3.41.7
spacewalk-backend-applet - update to 4.3.28-150400.3.41.7
susemanager-tools - update to 4.3.35-150400.3.48.6
susemanager - update to 4.3.35-150400.3.48.6
spacewalk-base-minimal - update to 4.3.38-150400.3.42.6
spacewalk-base - update to 4.3.38-150400.3.42.6
spacewalk-html - update to 4.3.38-150400.3.42.6
spacewalk-base-minimal-config - update to 4.3.38-150400.3.42.6
uyuni-config-modules - update to 4.3.41-150400.3.47.6
susemanager-sls - update to 4.3.41-150400.3.47.6
spacewalk-java-lib - update to 4.3.73-150400.3.79.1
spacewalk-taskomatic - update to 4.3.73-150400.3.79.1
spacewalk-java-postgresql - update to 4.3.73-150400.3.79.1
spacewalk-java-config - update to 4.3.73-150400.3.79.1
spacewalk-java - update to 4.3.73-150400.3.79.1
susemanager-docs_en-pdf - update to 4.3-150400.9.56.4
susemanager-docs_en - update to 4.3-150400.9.56.4
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.6
IBM Match 360 - update to 5.0.1
IBM Spectrum Control - update to 5.4.12
eap7-jbossws-cxf (Red Hat package) - addressed in versions 5.4.12-1.Final_redhat_00001.1.el7eap, 5.4.12-1.Final_redhat_00001.1.el8eap, 5.4.12-1.Final_redhat_00001.1.el9eap
eap7-hibernate-validator (Red Hat package) - addressed in versions 6.0.23-2.SP1_redhat_00001.1.el7eap, 6.0.23-2.SP1_redhat_00001.1.el8eap, 6.0.23-2.SP1_redhat_00001.1.el9eap
IBM Tivoli Monitoring - update to 6.3.0.7 Plus Service Pack 5
eap7-wildfly (Red Hat package) - addressed in versions 7.4.19-1.GA_redhat_00002.1.el7eap, 7.4.19-1.GA_redhat_00002.1.el8eap, 7.4.19-1.GA_redhat_00002.1.el9eap
IBM Qradar SIEM - update to 7.5.0 Update Pack 8 IF01
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.16
Storage Protect Operations Center - update to 8.1.23
IBM SPSS Collaboration and Deployment Services - update to 8.5.0.0.14
IBM WebSphere Application Server - addressed in versions 8.5.5.26, 9.0.5.20
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.15, 8.7.9
Operational Decision Manager - addressed in versions 8.10.5.2 Interim fix 1, 8.11.0.1 Interim fix 30, 8.11.1 Interim fix 24, 8.12.0.1 Interim fix 5
Maximo Application Suite - Monitor Component - addressed in versions 8.10.9, 8.11.6
IBM Maximo Application Suite - addressed in versions 8.10.14, 8.11.11
Maximo Application Suite - Predict Component - update to 9.0.0
IBM TXSeries for Multiplatforms - update to 9.1.0.3
IBM MQ - addressed in versions 9.1.0.22, 9.2.0.26, 9.3.0.20, 9.4
Telco Service Activator - update to 9.1.31
IBM License Metric Tool - update to 9.2.36
IBM CICS TX Advanced - addressed in versions 10.1.0.0 ifix26, 11.1.0.0 ifix19
IBM CICS TX Standard - update to 11.1.0.0 ifix19
IBM Cognos Analytics - addressed in versions 11.2.4 FP4, 12.0.4
Event Streams - update to 11.4.0
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 5
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF035, 21.0.3.32, 23.0.2.4, 24.0.0-IF001
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.15, 23.0.16
Business Automation Insights - update to 23.0.2.0.6
IBM Observability with Instana - update to 268

External References

Related Security Bulletins