REDHAT-BUG-2379485: Medium severity Connect2id Nimbus JOSE + JWT vulnerability
Connect2id Nimbus JOSE + JWT before 10.0.2 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2379485?
The severity of REDHAT-BUG-2379485 is considered to be high due to the potential for denial of service.
How do I fix REDHAT-BUG-2379485?
To fix REDHAT-BUG-2379485, upgrade to Nimbus JOSE + JWT version 10.0.2 or later.
Who is affected by REDHAT-BUG-2379485?
REDHAT-BUG-2379485 affects users of Connect2id Nimbus JOSE + JWT prior to version 10.0.2.
What type of vulnerability is REDHAT-BUG-2379485?
REDHAT-BUG-2379485 is a denial of service vulnerability caused by uncontrolled recursion in processing JWT claims.
Is REDHAT-BUG-2379485 related to Gson 2.11.0?
No, REDHAT-BUG-2379485 is independent of the Gson 2.11.0 issue.