CVE & CISA-KEV Catalog

CVE-2023-37464

HIGH
8.6
CVSS v3
NVD

Description

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a version >= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm (e.g. AES CBC).

CWE-327

How to fix

Remediation Available
cjoseDebian
Fixed in:0.6.1+dfsg1-1+deb11u1CVE-2023-37464
Fixed in:0.6.2.1-1+deb12u1CVE-2023-37464
Fixed in:0.6.2.2-1CVE-2023-37464
Fixed in:0.6.2.2-1CVE-2023-37464
cjoseRocky
Fixed in:0:0.6.1-3.module+el8.2.0+19461+3a40b6ee.src::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.s390x::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.ppc64le::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.s390x::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.s390x::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.x86_64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.src::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.x86_64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.1.0+19504+b2d26fa1.ppc64le::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:0.6.1-3.module+el8.1.0+19504+b2d26fa1.x86_64::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:0.6.1-3.module+el8.1.0+19504+b2d26fa1.src::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.src::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.src::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.x86_64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.aarch64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.ppc64le::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.2.0+19461+3a40b6ee.x86_64::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:0.6.1-3.module+el8.2.0+19461+3a40b6ee.ppc64le::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.aarch64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.ppc64le::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.aarch64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
cjoseRed Hat / RHEL
Fixed in:0:0.6.1-3.module+el8.2.0+19461+3a40b6ee.x86_64::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.s390x::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.aarch64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.ppc64le::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.s390x::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.ppc64le::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.x86_64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.src::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.aarch64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.1.0+19504+b2d26fa1.ppc64le::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:0.6.1-3.module+el8.1.0+19504+b2d26fa1.x86_64::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:0.6.1-3.module+el8.1.0+19504+b2d26fa1.src::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:0.6.1-3.module+el8.2.0+19461+3a40b6ee.ppc64le::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:0.6.1-3.module+el8.2.0+19461+3a40b6ee.src::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.aarch64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.ppc64le::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.s390x::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.x86_64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.src::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.src::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.x86_64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
cjose-debuginfoRocky
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.ppc64le::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.2.0+19461+3a40b6ee.x86_64::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:0.6.1-3.module+el8.2.0+19461+3a40b6ee.ppc64le::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.x86_64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.s390x::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.aarch64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.1.0+19504+b2d26fa1.x86_64::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:0.6.1-3.module+el8.1.0+19504+b2d26fa1.ppc64le::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.x86_64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.s390x::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.ppc64le::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.aarch64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.x86_64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.s390x::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.ppc64le::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.aarch64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
cjose-debuginfoRed Hat / RHEL
Fixed in:0:0.6.1-3.module+el8.2.0+19461+3a40b6ee.x86_64::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:0.6.1-3.module+el8.2.0+19461+3a40b6ee.ppc64le::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.x86_64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.s390x::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.ppc64le::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.aarch64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.1.0+19504+b2d26fa1.x86_64::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:0.6.1-3.module+el8.1.0+19504+b2d26fa1.ppc64le::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.x86_64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.s390x::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.ppc64le::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.aarch64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.x86_64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.s390x::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.ppc64le::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.aarch64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
cjose-debugsourceRed Hat / RHEL
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.x86_64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.aarch64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.1.0+19504+b2d26fa1.ppc64le::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.x86_64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.2.0+19461+3a40b6ee.x86_64::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.s390x::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.aarch64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.ppc64le::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.ppc64le::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.s390x::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.x86_64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.aarch64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.2.0+19461+3a40b6ee.ppc64le::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.ppc64le::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.1.0+19504+b2d26fa1.x86_64::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.s390x::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
cjose-debugsourceRocky
Fixed in:0:0.6.1-3.module+el8.2.0+19461+3a40b6ee.x86_64::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:0.6.1-3.module+el8.2.0+19461+3a40b6ee.ppc64le::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:0.6.1-3.module+el8.1.0+19504+b2d26fa1.x86_64::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.aarch64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.ppc64le::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.1.0+19504+b2d26fa1.ppc64le::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.x86_64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.s390x::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.ppc64le::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.x86_64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.s390x::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.aarch64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.s390x::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.ppc64le::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.x86_64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.aarch64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_2RHSA-2023:4411
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
Fixed in:0:0.6.1-13.el9_0RHSA-2023:4417
cjose-develRocky
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.ppc64le::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.2.0+19461+3a40b6ee.x86_64::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.aarch64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.s390x::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.aarch64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.ppc64le::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.x86_64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.2.0+19461+3a40b6ee.ppc64le::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:0.6.1-3.module+el8.1.0+19504+b2d26fa1.x86_64::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.x86_64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.x86_64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.ppc64le::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.s390x::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.1.0+19504+b2d26fa1.ppc64le::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.s390x::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.aarch64::mod_auth_openidc:2.3RHSA-2023:4408
cjose-develRed Hat / RHEL
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.aarch64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.1.0+19504+b2d26fa1.ppc64le::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.ppc64le::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.x86_64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.s390x::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.s390x::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.2.0+19461+3a40b6ee.x86_64::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.ppc64le::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.aarch64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.4.0+19462+14bde120.aarch64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.ppc64le::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.8.0+19464+578f4546.x86_64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:0.6.1-3.module+el8.2.0+19461+3a40b6ee.ppc64le::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.s390x::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:0.6.1-3.module+el8.1.0+19504+b2d26fa1.x86_64::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c.x86_64::mod_auth_openidc:2.3RHSA-2023:4408
mod_auth_openidcRed Hat / RHEL
Fixed in:0:2.3.7-4.module+el8.1.0+19504+b2d26fa1.3.src::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.ppc64le::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.s390x::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.aarch64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.x86_64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.ppc64le::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.src::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:2.3.7-4.module+el8.1.0+19504+b2d26fa1.3.ppc64le::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.src::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3.src::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.x86_64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3.ppc64le::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:2.3.7-4.module+el8.1.0+19504+b2d26fa1.3.x86_64::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.s390x::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.ppc64le::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.src::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.aarch64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.aarch64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3.x86_64::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.x86_64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.s390x::mod_auth_openidc:2.3RHSA-2023:4418
mod_auth_openidcRocky
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.src::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.ppc64le::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.3.7-4.module+el8.1.0+19504+b2d26fa1.3.ppc64le::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.x86_64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.s390x::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.ppc64le::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.aarch64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.aarch64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:2.3.7-4.module+el8.1.0+19504+b2d26fa1.3.x86_64::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3.ppc64le::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.s390x::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:2.3.7-4.module+el8.1.0+19504+b2d26fa1.3.src::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3.x86_64::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.x86_64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.s390x::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3.src::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.aarch64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.src::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.x86_64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.ppc64le::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.src::mod_auth_openidc:2.3RHSA-2023:4409
mod_auth_openidc-debuginfoRed Hat / RHEL
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.ppc64le::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3.ppc64le::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.aarch64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:2.3.7-4.module+el8.1.0+19504+b2d26fa1.3.x86_64::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.x86_64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.aarch64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.ppc64le::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.x86_64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3.x86_64::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.ppc64le::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:2.3.7-4.module+el8.1.0+19504+b2d26fa1.3.ppc64le::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.s390x::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.x86_64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.aarch64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.s390x::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.s390x::mod_auth_openidc:2.3RHSA-2023:4409
mod_auth_openidc-debuginfoRocky
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.x86_64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.ppc64le::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3.x86_64::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.aarch64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.3.7-4.module+el8.1.0+19504+b2d26fa1.3.ppc64le::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.aarch64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:2.3.7-4.module+el8.1.0+19504+b2d26fa1.3.x86_64::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.s390x::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3.ppc64le::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.s390x::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.aarch64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.x86_64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.x86_64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.s390x::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.ppc64le::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.ppc64le::mod_auth_openidc:2.3RHSA-2023:4409
mod_auth_openidc-debugsourceRocky
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.s390x::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.ppc64le::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.s390x::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.s390x::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.ppc64le::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.3.7-4.module+el8.1.0+19504+b2d26fa1.3.ppc64le::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.x86_64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3.ppc64le::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.aarch64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.x86_64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.aarch64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3.x86_64::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:2.3.7-4.module+el8.1.0+19504+b2d26fa1.3.x86_64::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.aarch64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.x86_64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.ppc64le::mod_auth_openidc:2.3RHSA-2023:4418
mod_auth_openidc-debugsourceRed Hat / RHEL
Fixed in:0:2.3.7-4.module+el8.1.0+19504+b2d26fa1.3.x86_64::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3.ppc64le::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.x86_64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.aarch64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.s390x::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.aarch64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.x86_64::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.ppc64le::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.s390x::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.x86_64::mod_auth_openidc:2.3RHSA-2023:4418
Fixed in:0:2.3.7-11.module+el8.6.0+14082+b6f23e95.aarch64::mod_auth_openidc:2.3RHSA-2023:4408
Fixed in:0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3.x86_64::mod_auth_openidc:2.3RHSA-2023:4410
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.s390x::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:2.3.7-8.module+el8.4.0+9707+f2438af7.ppc64le::mod_auth_openidc:2.3RHSA-2023:4409
Fixed in:0:2.3.7-4.module+el8.1.0+19504+b2d26fa1.3.ppc64le::mod_auth_openidc:2.3RHSA-2023:4429
Fixed in:0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6.ppc64le::mod_auth_openidc:2.3RHSA-2023:4418
cjoseUbuntu
Fixed in:0.6.0+dfsg1-1ubuntu0.1~esm1USN-6307-1
Fixed in:0.6.1+dfsg1-1ubuntu0.1USN-6307-1
Fixed in:0.6.1+dfsg1-3ubuntu1.1USN-6307-1
Fixed in:0.6.2.1-1ubuntu0.1USN-6307-1
libcjose0Ubuntu
Fixed in:0.6.0+dfsg1-1ubuntu0.1~esm1USN-6307-1
Fixed in:0.6.1+dfsg1-1ubuntu0.1USN-6307-1
Fixed in:0.6.1+dfsg1-3ubuntu1.1USN-6307-1
Fixed in:0.6.2.1-1ubuntu0.1USN-6307-1

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeChanged

Impact

ConfidentialityNone
IntegrityHigh
AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Exploit Intelligence

0.60%probability of exploitation in 30 days
44thpercentile

Moderate risk: more likely to be exploited than 44% of all known CVEs.

References

Third-Party Advisory1
Release Notes1

Related Vulnerabilities

Other CWE-327 vulnerabilities, ordered by exploit likelihood. View all

CVESeverityCVSSEPSSExploitedFix
CVE-2015-2808Low3.774%-Fix
CVE-2023-34039Critical9.864%-Fix
CVE-2016-6602Critical9.855%--
CVE-2014-8687Critical9.844%--
CVE-2020-13777High7.418%-Fix
CVE-2017-17428Medium5.915%--
Embed a live status badge for CVE-2023-37464
CVE-2023-37464 severity badge

Markdown

[![CVE-2023-37464](https://tridentstack.com/cve/badge/CVE-2023-37464.svg)](https://tridentstack.com/cve/CVE-2023-37464)

HTML

<a href="https://tridentstack.com/cve/CVE-2023-37464"><img src="https://tridentstack.com/cve/badge/CVE-2023-37464.svg" alt="CVE-2023-37464"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2024-11-21.