cjose vulnerabilities

1 known vulnerability in cjose from Cisco. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  cjose: Use of a Broken or Risky Cryptographic Algorithm

  CVE-2023-37464Jul 14, 2023OpenIDC

  OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets