1. CVE-Search
  2. CVE-2021-29443
ID CVE-2021-29443
Summary jose is an npm library providing a number of cryptographic operations. In vulnerable versions AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. A possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). All major release versions have had a patch released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `^1.28.1 || ^2.0.5 || >=3.11.4`. Users should upgrade their v1.x dependency to ^1.28.1, their v2.x dependency to ^2.0.5, and their v3.x dependency to ^3.11.4. Thanks to Jason from Microsoft Vulnerability Research (MSVR) for bringing this up and Eva Sarafianou (@esarafianou) for helping to score this advisory.
References
Vulnerable Configurations
  • cpe:2.3:a:jose_project:jose:1.0.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.0.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.0.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.0.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.0.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.0.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.3.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.3.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.4.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.4.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.4.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.4.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.5.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.5.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.5.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.5.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.5.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.5.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.6.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.6.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.6.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.6.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.7.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.7.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.8.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.8.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.9.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.9.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.9.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.9.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.9.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.9.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.10.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.10.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.10.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.10.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.10.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.10.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.11.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.11.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.12.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.12.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.12.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.12.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.13.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.13.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.14.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.14.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.15.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.15.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.15.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.15.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.16.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.16.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.16.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.16.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.16.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.16.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.17.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.17.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.17.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.17.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.17.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.17.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.18.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.18.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.18.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.18.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.18.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.18.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.19.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.19.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.20.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.20.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.21.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.21.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.21.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.21.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.22.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.22.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.22.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.22.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.22.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.22.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.23.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.23.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.24.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.24.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.24.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.24.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.25.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.25.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.25.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.25.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.25.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.25.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.26.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.26.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.26.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.26.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.27.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.27.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.27.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.27.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.27.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.27.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.27.3:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.27.3:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.28.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.28.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:2.0.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:2.0.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:2.0.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:2.0.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:2.0.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:2.0.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:2.0.3:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:2.0.3:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:2.0.4:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:2.0.4:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.0.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.0.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.0.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.0.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.0.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.0.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.1.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.1.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.1.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.1.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.1.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.1.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.1.3:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.1.3:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.2.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.2.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.3.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.3.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.3.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.3.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.3.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.3.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.4.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.4.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.5.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.5.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.5.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.5.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.5.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.5.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.5.3:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.5.3:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.5.4:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.5.4:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.6.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.6.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.6.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.6.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.6.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.6.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.7.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.7.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.7.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.7.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.8.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.8.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.9.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.9.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.10.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.10.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.11.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.11.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.11.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.11.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.11.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.11.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.11.3:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.11.3:*:*:*:*:node.js:*:*
CVSS
Base: 4.3 (as of 23-04-2021 - 20:38)
Impact:
Exploitability:
CWE CWE-203
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:N/A:N
Last major update 23-04-2021 - 20:38
Published 16-04-2021 - 18:15
Last modified 23-04-2021 - 20:38
Back to Top