okta-sdk-golang v2.20.0, high risk vulnerabilities with go.jose dependency

[shikhargiri]

Describe the bug?

Detailed paths
Introduced through: github.com/okta/[email protected] › github.com/go-jose/[email protected]

Security information
Factors contributing to the scoring:
Snyk: CVSS 7.5 - High Severity

NVD: NVD only publishes analysis of vulnerabilities which are assigned a CVE ID. This vulnerability currently does not have an assigned CVE ID.
Why are the scores different? Learn how Snyk evaluates vulnerability scores

Overview
Affected versions of this package are vulnerable to Denial of Service (DoS) when decrypting JWE inputs. An attacker can cause a denial-of-service by providing a PBES2 encrypted JWE blob with a very large p2c value.

What is expected to happen?

We are considering OKTA to release an stable version with the fix for this findings.

What is the actual behavior?

Overview
Affected versions of this package are vulnerable to Denial of Service (DoS) when decrypting JWE inputs. An attacker can cause a denial-of-service by providing a PBES2 encrypted JWE blob with a very large p2c value.

Reproduction Steps?

This vulnerabilities dependency was identified from OKTA library we are using.

Additional Information?

No response

Golang Version

1.21.4

SDK Version

OS version

No response

[github-actions]

This issue has been marked stale because there has been no activity within the last 14 days. To keep this issue active, remove the stale label.

[github-actions]

This issue has been marked stale because there has been no activity within the last 14 days. To keep this issue active, remove the stale label.

[github-actions]

This issue has been marked stale because there has been no activity within the last 14 days. To keep this issue active, remove the stale label.