php · web-token/jwt-libraryCritical
web-token/jwt-library: PBES2AESKW enforces max iteration count to prevent DoS
PBES2AESKW::unwrapKey() now enforces a configurable maximum iteration count (DEFAULT_MAX_COUNT = 1_000_000) in checkHeaderAdditionalParameters() before any PBKD
What changed
PBES2AESKW::unwrapKey() now enforces a configurable maximum iteration count (DEFAULT_MAX_COUNT = 1_000_000) in checkHeaderAdditionalParameters() before any PBKDF2 computation, preventing CPU amplification DoS.
Who it affects
Applications that register any PBES2-HS*+A*KW algorithm in their decryption AlgorithmManager.
What to do today
Upgrade to the patched version or validate/limit the p2c header with a custom header checker, or do not enable PBES2 algorithms for untrusted tokens.
The trail
Collected→
Audited→
Written→
Published