CVE-2022-36083

JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named `p2c` PBES2 Count, which determines how many PBKDF2 iterations must be executed in order to derive a CEK wrapping key. The purpose of this parameter is to intentionally slow down the key derivation function in order to make password brute-force and dictionary attacks more expensive. This makes the PBES2 algorithms unsuitable for situations where the JWE is coming from an untrusted source: an adversary can intentionally pick an extremely high PBES2 Count value, that will initiate a CPU-bound computation that may take an unreasonable amount of time to finish. Under certain conditions, it is possible to have the user's environment consume unreasonable amount of CPU time. The impact is limited only to users utilizing the JWE decryption APIs with symmetric secrets to decrypt JWEs from untrusted parties who do not limit the accepted JWE Key Management Algorithms (`alg` Header Parameter) using the `keyManagementAlgorithms` (or `algorithms` in v1.x) decryption option or through other means. The `v1.28.2`, `v2.0.6`, `v3.20.4`, and `v4.9.2` releases limit the maximum PBKDF2 iteration count to `10000` by default. It is possible to adjust this limit with a newly introduced `maxPBES2Count` decryption option. If users are unable to upgrade their required library version, they have two options depending on whether they expect to receive JWEs using any of the three PBKDF2-based JWE key management algorithms. They can use the `keyManagementAlgorithms` decryption option to disable accepting PBKDF2 altogether, or they can inspect the JOSE Header prior to using the decryption API and limit the PBKDF2 iteration count (`p2c` Header Parameter).

JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named `p2c` PBES2 Count, which determines how many PBKDF2 iterations must be executed in order to derive a CEK wrapping key. The purpose of this parameter is to intentionally slow down the key derivation function in order to make password brute-force and dictionary attacks more expensive. This makes the PBES2 algorithms unsuitable for situations where the JWE is coming from an untrusted source: an adversary can intentionally pick an extremely high PBES2 Count value, that will initiate a CPU-bound computation that may take an unreasonable amount of time to finish. Under certain conditions, it is possible to have the user's environment consume unreasonable amount of CPU time. The impact is limited only to users utilizing the JWE decryption APIs with symmetric secrets to decrypt JWEs from untrusted parties who do not limit the accepted JWE Key Management Algorithms (`alg` Header Parameter) using the `keyManagementAlgorithms` (or `algorithms` in v1.x) decryption option or through other means. The `v1.28.2`, `v2.0.6`, `v3.20.4`, and `v4.9.2` releases limit the maximum PBKDF2 iteration count to `10000` by default. It is possible to adjust this limit with a newly introduced `maxPBES2Count` decryption option. If users are unable to upgrade their required library version, they have two options depending on whether they expect to receive JWEs using any of the three PBKDF2-based JWE key management algorithms. They can use the `keyManagementAlgorithms` decryption option to disable accepting PBKDF2 altogether, or they can inspect the JOSE Header prior to using the decryption API and limit the PBKDF2 iteration count (`p2c` Header Parameter).

The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named `p2c` ([PBES2 Count](https://www.rfc-editor.org/rfc/rfc7518.html#section-4.8.1.2)), which determines how many PBKDF2 iterations must be executed in order to derive a CEK wrapping key. The purpose of this parameter is to intentionally slow down the key derivation function in order to make password brute-force and dictionary attacks more expensive. This makes the PBES2 algorithms unsuitable for situations where the JWE is coming from an untrusted source: an adversary can intentionally pick an extremely high PBES2 Count value, that will initiate a CPU-bound computation that may take an unreasonable amount of time to finish. ### Impact Under certain conditions (see below) it is possible to have the user's environment consume unreasonable amount of CPU time. ### Affected users The impact is limited only to users utilizing the JWE decryption APIs with symmetric secrets to decrypt JWEs from untrusted parties who do not limit the accepted JWE Key Management Algorithms (`alg` Header Parameter) using the `keyManagementAlgorithms` (or `algorithms` in v1.x) decryption option or through other means. The PBKDF2-based JWE Key Management Algorithm Identifiers are - `PBES2-HS256+A128KW` - `PBES2-HS384+A192KW` - `PBES2-HS512+A256KW` e.g. ```js const secret = new Uint8Array(16) const jwe = '...' // JWE from an untrusted party await jose.compactDecrypt(jwe, secret) ``` You are NOT affected if any of the following applies to you - Your code does not use the JWE APIs - Your code only produces JWE tokens - Your code only decrypts JWEs using an asymmetric JWE Key Management Algorithm (this means you're providing an asymmetric key object to the JWE decryption API) - Your code only accepts JWEs produced by trusted sources - Your code limits the accepted JWE Key Management Algorithms using the `keyManagementAlgorithms` decryption option not including any of the PBKDF2-based JWE key management algorithms ### Patches `v1.28.2`, `v2.0.6`, `v3.20.4`, and `v4.9.2` releases limit the maximum PBKDF2 iteration count to `10000` by default. It is possible to adjust this limit with a newly introduced `maxPBES2Count` decryption option. ### Workarounds All users should be able to upgrade given all stable semver major release lines have had new a patch release introduced which limits the PBKDF2 iteration count to `10000` by default. This removes the ability to craft JWEs that would consume unreasonable amount of CPU time. If users are unable to upgrade their required library version they have two options depending on whether they expect to receive JWEs using any of the three PBKDF2-based JWE key management algorithms. - they can use the `keyManagementAlgorithms` decryption option to disable accepting PBKDF2 altogether - they can inspect the JOSE Header prior to using the decryption API and limit the PBKDF2 iteration count (`p2c` Header Parameter) ### For more information If you have any questions or comments about this advisory: * Open an discussion in the project's [repository](https://github.com/panva/jose/discussions/new?category=q-a&title=GHSA-jv3g-j58f-9mq9%20advisory%20question) * Email me at [panva.ip@gmail.com](mailto:panva.ip@gmail.com)

The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named `p2c` ([PBES2 Count](https://www.rfc-editor.org/rfc/rfc7518.html#section-4.8.1.2)), which determines how many PBKDF2 iterations must be executed in order to derive a CEK wrapping key. The purpose of this parameter is to intentionally slow down the key derivation function in order to make password brute-force and dictionary attacks more expensive. This makes the PBES2 algorithms unsuitable for situations where the JWE is coming from an untrusted source: an adversary can intentionally pick an extremely high PBES2 Count value, that will initiate a CPU-bound computation that may take an unreasonable amount of time to finish. ### Impact Under certain conditions (see below) it is possible to have the user's environment consume unreasonable amount of CPU time. ### Affected users The impact is limited only to users utilizing the JWE decryption APIs with symmetric secrets to decrypt JWEs from untrusted parties who do not limit the accepted JWE Key Management Algorithms (`alg` Header Parameter) using the `keyManagementAlgorithms` (or `algorithms` in v1.x) decryption option or through other means. The PBKDF2-based JWE Key Management Algorithm Identifiers are - `PBES2-HS256+A128KW` - `PBES2-HS384+A192KW` - `PBES2-HS512+A256KW` e.g. ```js const secret = new Uint8Array(16) const jwe = '...' // JWE from an untrusted party await jose.compactDecrypt(jwe, secret) ``` You are NOT affected if any of the following applies to you - Your code does not use the JWE APIs - Your code only produces JWE tokens - Your code only decrypts JWEs using an asymmetric JWE Key Management Algorithm (this means you're providing an asymmetric key object to the JWE decryption API) - Your code only accepts JWEs produced by trusted sources - Your code limits the accepted JWE Key Management Algorithms using the `keyManagementAlgorithms` decryption option not including any of the PBKDF2-based JWE key management algorithms ### Patches `v1.28.2`, `v2.0.6`, `v3.20.4`, and `v4.9.2` releases limit the maximum PBKDF2 iteration count to `10000` by default. It is possible to adjust this limit with a newly introduced `maxPBES2Count` decryption option. ### Workarounds All users should be able to upgrade given all stable semver major release lines have had new a patch release introduced which limits the PBKDF2 iteration count to `10000` by default. This removes the ability to craft JWEs that would consume unreasonable amount of CPU time. If users are unable to upgrade their required library version they have two options depending on whether they expect to receive JWEs using any of the three PBKDF2-based JWE key management algorithms. - they can use the `keyManagementAlgorithms` decryption option to disable accepting PBKDF2 altogether - they can inspect the JOSE Header prior to using the decryption API and limit the PBKDF2 iteration count (`p2c` Header Parameter) ### For more information If you have any questions or comments about this advisory: * Open an discussion in the project's [repository](https://github.com/panva/jose/discussions/new?category=q-a&title=GHSA-jv3g-j58f-9mq9%20advisory%20question) * Email me at [panva.ip@gmail.com](mailto:panva.ip@gmail.com)

JOSE es "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS sin dependencias usando la criptografía nativa del tiempo de ejecución en Node.js, Browser, Cloudflare Workers, Electron y Deno. Los algoritmos de administración de claves JWE basados en PBKDF2 esperan un parámetro de encabezado JOSE llamado "p2c" PBES2 Count, que determina cuántas iteraciones de PBKDF2 deben ejecutarse para derivar una clave envolvente CEK. El propósito de este parámetro es ralentizar intencionadamente la función de derivación de la clave para que los ataques de fuerza bruta y de diccionario a las contraseñas sean más costosos. Esto hace que los algoritmos PBES2 sean inapropiados para situaciones en las que el JWE procede de una fuente no confiable: un adversario puede elegir intencionadamente un valor de PBES2 Count extremadamente alto, que iniciará un cálculo limitado por la CPU que puede tardar una cantidad de tiempo irrazonable en terminar. Bajo determinadas condiciones, es posible que el entorno del usuario consuma una cantidad irrazonable de tiempo de CPU. El impacto es limitado sólo a usuarios que usan las API de descifrado de JWE con secretos simétricos para descifrar JWE de partes no confiables que no limitan los algoritmos de administración de claves JWE aceptados (parámetro de cabecera "alg") usando la opción de descifrado "keyManagementAlgorithms" (o "algorithms" en v1.x) o por otros medios. Las versiones "v1.28.2", "v2.0.6", "v3.20.4" y "v4.9.2" limitan el número máximo de iteraciones de PBKDF2 a "10000" por defecto. Es posible ajustar este límite con la nueva opción de descifrado "maxPBES2Count". Si los usuarios no pueden actualizar la versión de la biblioteca que necesitan, se presentan dos opciones dependiendo de si esperan recibir JWEs que usen alguno de los tres algoritmos de administración de claves JWE basados en PBKDF2. Pueden usar la opción de descifrado "keyManagementAlgorithms" para deshabilitar la aceptación de PBKDF2 por completo, o pueden inspeccionar el encabezado JOSE antes de usar la API de descifrado y limitar el recuento de iteraciones de PBKDF2 (parámetro de encabezado "p2c")