Advisories · Technology
OpenIDC cjose.
Every CVE that names OpenIDC cjose among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.1 CriticalCritical · CVSS 9+
OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption
- OpenIDC cjose
- Hard-coded credentials
- Weak cryptography or TLS
- CVSS 8.2 High
OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW)
- OpenIDC cjose
- Memory corruption
- CVSS 8.6 High
Incorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjose
- OpenIDC cjose
- Weak cryptography or TLS