ID CVE-2021-29445
Summary jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. But a possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). A patch was released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `>=3.11.4`. Users should upgrade to `^3.11.4`.
References
Vulnerable Configurations
  • cpe:2.3:a:jose_project:jose:0.9.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:0.9.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:0.9.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:0.9.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:0.9.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:0.9.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:0.10.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:0.10.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:0.11.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:0.11.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:0.11.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:0.11.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:0.11.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:0.11.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:0.11.3:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:0.11.3:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:0.11.4:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:0.11.4:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:0.11.5:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:0.11.5:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:0.12.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:0.12.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.0.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.0.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.0.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.0.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.0.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.0.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.3.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.3.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.4.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.4.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.4.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.4.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.5.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.5.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.5.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.5.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.5.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.5.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.6.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.6.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.6.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.6.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.7.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.7.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.8.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.8.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.9.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.9.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.9.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.9.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.9.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.9.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.10.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.10.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.10.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.10.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.10.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.10.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.11.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.11.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.12.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.12.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.12.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.12.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.13.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.13.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.14.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.14.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.15.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.15.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.15.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.15.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.16.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.16.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.16.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.16.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.16.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.16.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.17.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.17.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.17.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.17.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.17.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.17.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.18.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.18.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.18.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.18.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.18.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.18.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.19.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.19.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.20.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.20.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.21.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.21.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.21.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.21.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.22.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.22.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.22.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.22.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.22.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.22.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.23.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.23.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.24.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.24.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.24.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.24.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.25.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.25.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.25.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.25.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.25.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.25.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.26.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.26.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.26.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.26.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.27.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.27.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.27.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.27.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.27.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.27.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.27.3:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.27.3:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.28.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.28.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:1.28.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:1.28.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:2.0.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:2.0.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:2.0.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:2.0.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:2.0.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:2.0.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:2.0.3:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:2.0.3:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:2.0.4:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:2.0.4:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:2.0.5:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:2.0.5:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.0.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.0.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.0.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.0.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.0.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.0.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.1.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.1.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.1.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.1.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.1.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.1.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.1.3:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.1.3:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.2.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.2.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.3.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.3.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.3.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.3.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.3.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.3.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.4.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.4.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.5.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.5.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.5.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.5.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.5.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.5.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.5.3:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.5.3:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.5.4:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.5.4:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.6.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.6.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.6.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.6.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.6.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.6.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.7.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.7.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.7.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.7.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.8.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.8.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.9.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.9.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.10.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.10.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.11.0:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.11.0:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.11.1:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.11.1:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.11.2:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.11.2:*:*:*:*:node.js:*:*
  • cpe:2.3:a:jose_project:jose:3.11.3:*:*:*:*:node.js:*:*
    cpe:2.3:a:jose_project:jose:3.11.3:*:*:*:*:node.js:*:*
CVSS
Base: 4.3 (as of 23-04-2021 - 20:33)
Impact:
Exploitability:
CWE CWE-203
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:N/A:N
Last major update 23-04-2021 - 20:33
Published 16-04-2021 - 22:15
Last modified 23-04-2021 - 20:33
Back to Top