Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Mageia 8 & 9: MGASA-2023-0350 Critical: cjose Decryption Flaw

mageia
Calendar Grey December 18, 2023
Dist Mageia Esm H88
The latest cjose library updates address a severe security flaw in Mageia that affects decryption mechanisms, published on December 18, 2023.
The updated packages fix a security vulnerability: The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE

Summary

The updated packages fix a security vulnerability: The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated Authentication Tag and to modify the JWE accordingly. (CVE-2023-37464)

References

- https://bugs.mageia.org/show_bug.cgi?id=32274

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFWAPMYYVBO2U65HPYDTBEKNSXG4TP5C/

- https://www.cve.org/CVERecord?id=CVE-2023-37464

Topics%20covered

Topics Covered

security advisory critical mageia decryption issue authentication tag aes gcm

Resolution

SRPMS

- 9/core/cjose-0.6.1-3.1.mga9

- 8/core/cjose-0.6.1-1.1.mga8

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 18 Dec 2023
URL: https://advisories.mageia.org/MGASA-2023-0350.html
Type: security
CVE: CVE-2023-37464

Topics%20covered

Topics Covered

security advisory critical mageia decryption issue authentication tag aes gcm

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here