Decryption of malicious PBES2 JWE objects can consume unbounded system resources. The go-jose package is subject to a "billion hashes attack" causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-service.
Advisories are based on vulnerability information provided by Grype from Anchore.
Products
Chainguard Images© 2024 Chainguard, Inc.
