by Kastro
Paper/Archive/CVE-2023-23928

CVE-2023-23928

ulrikstrid reason-jose — reason-jose ignores signature checks

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 39.8.398 × 208.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

reason-jose is a JOSE implementation in ReasonML and OCaml.`Jose.Jws.validate` does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks. Such tampering could expose applications using reason-jose to authorization bypass. Applications relying on JWS claims assertion to enforce security boundaries may be vulnerable to privilege escalation. This issue has been patched in version 0.8.2.

Affected

ProductAffectedFixed inSource
reason-jose< 0.8.2–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)5.9CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/ulrikstrid/reason-jose/security/advisories/GHSA-7jj9-6qwv-wpm7refgithub.com/ulrikstrid/reason-jose/commit/36cd724db3cbec121757624da49072386bd869e5refgithub.com/ulrikstrid/reason-jose/releases/tag/v0.8.2