What is GHSA-6294-6rgp-fr7r?

GHSA-6294-6rgp-fr7r is a security advisory published by GitHub Security Advisories with Medium severity. jose2go vulnerable to denial of service via large p2c value

Which CVE IDs does GHSA-6294-6rgp-fr7r cover?

GHSA-6294-6rgp-fr7r covers the following CVE IDs: CVE-2023-50658. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6294-6rgp-fr7r?

GHSA-6294-6rgp-fr7r has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-6294-6rgp-fr7r?

GHSA-6294-6rgp-fr7r affects 1 product, including: go/github.com/dvsekhvalnov/jose2go:\u003c 1.6.0.

GHSA-6294-6rgp-fr7rMediumCVSS 5.3

jose2go vulnerable to denial of service via large p2c value

Vendor

GitHub Security Advisories

Published

February 29, 2024

Last Modified

February 3, 2026

🔗 CVE IDs covered (1)

CVE-2023-50658 →

📋 Description

The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

🎯 Affected products1

go/github.com/dvsekhvalnov/jose2go:< 1.6.0

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2023-50658
https://github.com/dvsekhvalnov/jose2go/commit/a4584e9dd7128608fedbc67892eba9697f0d5317
https://github.com/dvsekhvalnov/jose2go/compare/v1.5.0...v1.6.0
https://github.com/dvsekhvalnov/jose2go/issues/31
https://www.blackhat.com/us-23/briefings/schedule/#three-new-attacks-against-json-web-tokens-31695
https://pkg.go.dev/vuln/GO-2023-2409
https://github.com/advisories/GHSA-6294-6rgp-fr7r