erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value in a JOSE header.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service     (CPU consumption) via a large p2c (aka PBES2 Count) value in a JOSE header. (CVE-2023-50966)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of rabbitmq-server installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-50966 advisory.

  - erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service     (CPU consumption) via a large p2c (aka PBES2 Count) value in a JOSE header. (CVE-2023-50966)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of rabbitmq-server installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-50966 advisory.

  - erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service     (CPU consumption) via a large p2c (aka PBES2 Count) value in a JOSE header. (CVE-2023-50966)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-9484b6915b advisory.

    Re-reviewed Jose ver. 1.11.10

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-a8d7972ef6 advisory.

    Re-reviewed Jose ver. 1.11.10

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
225892	Linux Distros Unpatched Vulnerability : CVE-2023-50966	Nessus	Misc.	medium
216362	Azure Linux 3.0 Security Update: rabbitmq-server (CVE-2023-50966)	Nessus	Azure Linux Local Security Checks	medium
216359	CBL Mariner 2.0 Security Update: rabbitmq-server (CVE-2023-50966)	Nessus	MarinerOS Local Security Checks	medium
202456	Fedora 39 : erlang-jose (2024-9484b6915b)	Nessus	Fedora Local Security Checks	medium
202454	Fedora 40 : erlang-jose (2024-a8d7972ef6)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2023-50966

medium

Tenable Plugins

medium

medium

medium

medium

medium