[Snyk High flyway] - High Allocation of Resources Without Limits or Throttling(Due 03/22/2024)

[fec-jli]

https://app.snyk.io/org/fecgov/project/e6c155e9-f0ac-4a49-98fa-83c24f5b74b3#issue-SNYK-JAVA-COMNIMBUSDS-6247633

Introduced through
org.flywaydb:[email protected]
Fixed in
com.nimbusds:[email protected]
Exploit maturity
NO KNOWN EXPLOIT
Show less detail
Detailed paths
Introduced through: unknown:[email protected] › org.flywaydb:[email protected] › com.microsoft.azure:[email protected] › com.nimbusds:[email protected] › com.nimbusds:[email protected]
Security information
Factors contributing to the scoring:
Snyk: CVSS 7.5 - High Severity

NVD: Not available. NVD has not yet published its analysis.
Why are the scores different? Learn how Snyk evaluates vulnerability scores
Overview
com.nimbusds:nimbus-jose-jwt is a library for JSON Web Tokens (JWT)

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to a large JWE p2c header value (AKA iteration count) for the PasswordBasedDecrypter (PBKDF2) class. An attacker can cause resource consumption by specifying an excessively large iteration count.

Completion criteria:

• Not available. NVD has not yet published its analysis.