Skip to content
Fencer Vulns
high 8.6

CVE-2023-37464 json

Incorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjose

published 2023-07-14 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-41362

cvss
8.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits
0
none known

Summary

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a version >= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm (e.g. AES CBC).

Patch / fix

  • cisco cjose 0.6.2.2
  • cjose Debian 12 0.6.2.1-1+deb12u1
  • cjose Debian 14, Debian 13 0.6.2.2-1

debian advisories DEBIAN-CVE-2023-37464

  • cjose Ubuntu 20.04 LTS 0.6.1+dfsg1-1ubuntu0.1
  • cjose Ubuntu 22.04 LTS 0.6.1+dfsg1-3ubuntu1.1
  • cjose Ubuntu Pro 18.04 LTS 0.6.0+dfsg1-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2023-37464

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cjose RHEL 8 0.6.1-3.module+el8.8.0+19464+578f4546
  • mod_auth_openidc RHEL 8 2.4.9.4-1.module+el8.7.0+14797+4085fcb6
  • cjose RHEL 9 0.6.1-13.el9_2
  • cjose RHEL 8.1 E4S 0.6.1-3.module+el8.1.0+19504+b2d26fa1
  • mod_auth_openidc RHEL 8.1 E4S 2.3.7-4.module+el8.1.0+19504+b2d26fa1.3
  • cjose RHEL 9.0 EUS 0.6.1-13.el9_0
  • cjose RHEL 8.2 TUS, RHEL 8.2 E4S, RHEL 8.2 AUS 0.6.1-3.module+el8.2.0+19461+3a40b6ee
  • mod_auth_openidc RHEL 8.2 TUS, RHEL 8.2 E4S, RHEL 8.2 AUS 2.3.7-4.module+el8.2.0+6919+ac02cfd2.3

red hat advisories RHSA-2023:4429RHSA-2023:4417RHSA-2023:4418RHSA-2023:4411RHSA-2023:4410RHSA-2023:4409

  • cjose SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES for SAP 15 SP1 +16 more 0.6.1-150100.4.6.1
  • cjose SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +4 more 0.6.1-7.5.1

suse advisories SUSE-SU-2023:3230-1SUSE-SU-2023:3030-1

  • cjose AlmaLinux 9 0.6.1-13.el9_2.alma
  • cjose AlmaLinux 8 0.6.1-3.module_el8.8.0+3591+c9939da8
  • mod_auth_openidc AlmaLinux 8 2.4.9.4-1.module_el8.7.0+3305+9a59f0c3

almalinux advisories ALSA-2023:4411ALSA-2023:4418

  • cjose Rocky Linux 8 0.6.1-3.module+el8.8.0+1406+4a7f5371
  • mod_auth_openidc Rocky Linux 8 2.4.9.4-1.module+el8.7.0+1061+55d14382

rocky linux advisories RLSA-2023:4418

  • cjose Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 0.6.2.2-r0

alpine advisories ALPINE-CVE-2023-37464

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cjose Azure Linux 3.0 0.6.2.2-7

azure linux advisories AZL-36936

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-37464 updated cvss 7.5

cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE

  • Red Hat Enterprise Linux AppStream (v. 8) cjose 0.6.1-3.module+el8.8.0+19464+578f4546, mod_auth_openidc 2.4.9.4-1.module+el8.7.0+14797+4085fcb6
    fixed: vendor fix “Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm, such as AES CBC.” RHSA-2023:4418
  • Red Hat Enterprise Linux AppStream (v. 9) cjose 0.6.1-13.el9_2
    fixed: vendor fix “Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm, such as AES CBC.” RHSA-2023:4411
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) cjose 0.6.1-3.module+el8.2.0+19461+3a40b6ee, mod_auth_openidc 2.3.7-4.module+el8.2.0+6919+ac02cfd2.3
    fixed: vendor fix “Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm, such as AES CBC.” RHSA-2023:4410
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) cjose 0.6.1-3.module+el8.4.0+19462+14bde120, mod_auth_openidc 2.3.7-8.module+el8.4.0+9707+f2438af7
    fixed: vendor fix “Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm, such as AES CBC.” RHSA-2023:4409
  • Red Hat Enterprise Linux AppStream E4S (v. 8.1) cjose 0.6.1-3.module+el8.1.0+19504+b2d26fa1, mod_auth_openidc 2.3.7-4.module+el8.1.0+19504+b2d26fa1.3
    fixed: vendor fix “Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm, such as AES CBC.” RHSA-2023:4429
  • Red Hat Enterprise Linux AppStream E4S (v. 8.2) cjose 0.6.1-3.module+el8.2.0+19461+3a40b6ee, mod_auth_openidc 2.3.7-4.module+el8.2.0+6919+ac02cfd2.3
    fixed: vendor fix “Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm, such as AES CBC.” RHSA-2023:4410
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) cjose 0.6.1-3.module+el8.4.0+19462+14bde120, mod_auth_openidc 2.3.7-8.module+el8.4.0+9707+f2438af7
    fixed: vendor fix “Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm, such as AES CBC.” RHSA-2023:4409
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) cjose 0.6.1-3.module+el8.6.0+19463+7d2e1f9c, mod_auth_openidc 2.3.7-11.module+el8.6.0+14082+b6f23e95
    fixed: vendor fix “Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm, such as AES CBC.” RHSA-2023:4408
show 3 more
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) cjose 0.6.1-13.el9_0
    fixed: vendor fix “Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm, such as AES CBC.” RHSA-2023:4417
  • Red Hat Enterprise Linux AppStream TUS (v. 8.2) cjose 0.6.1-3.module+el8.2.0+19461+3a40b6ee, mod_auth_openidc 2.3.7-4.module+el8.2.0+6919+ac02cfd2.3
    fixed: vendor fix “Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm, such as AES CBC.” RHSA-2023:4410
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) cjose 0.6.1-3.module+el8.4.0+19462+14bde120, mod_auth_openidc 2.3.7-8.module+el8.4.0+9707+f2438af7
    fixed: vendor fix “Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm, such as AES CBC.” RHSA-2023:4409

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.71% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/OpenIDC/cjose/security/advisories/GHSA-3rhg-3gf2-6xgj referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

  • OpenIDC cjose
  • cisco cjose

Classification

Weakness
  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.