GHSA-8g9c-28fc-mcx2

Dashboard / Vulnerabilities / GHSA-8g9c-28fc-mcx2

GHSA-8g9c-28fc-mcx2

Summary: Duplicate Advisory: Microsoft Identity Denial of service vulnerability

Details: ### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-59j7-ghrg-fj52. This link is maintained to preserve external references. ### Original Description ### Impact An attacker could exploit this vulnerability by crafting a malicious JSON Web Encryption (JWE) token with a high compression ratio. This token, when processed by a server, leads to excessive memory allocation and processing time during decompression, causing a denial-of-service (DoS) condition. It's important to note that the attacker must have access to the public encrypt key registered with the IDP(Entra ID) for successful exploitation. _According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?_ A scope change (S:C) in the CVSS metric indicates that successful exploitation of this vulnerability could extend beyond the immediate processing of malicious tokens, affecting the overall availability of the system by causing a denial-of-service (DoS) condition. ### Patches The vulnerability has been fixed. Users should update **all** their Microsoft.IdentityModel versions to 7.1.2 (for 7x) or higher, 6.34.0 (for 6x) or higher, and 5.7.0 (for 5x). ### Workarounds No, users must upgrade. ### References https://aka.ms/IdentityModel/Jan2024/zip

References: https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-8g9c-28fc-mcx2, https://nvd.nist.gov/vuln/detail/CVE-2024-21319, https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet, https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/5.7.0, https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/6.34.0, https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/7.1.2, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319