Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/14078?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/14078?format=api", "vulnerability_id": "VCID-75q2-4q5c-fqf8", "summary": "Duplicate Advisory: Microsoft Identity Denial of service vulnerability\n### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-59j7-ghrg-fj52. This link is maintained to preserve external references.\n\n### Original Description\n\n### Impact\nAn attacker could exploit this vulnerability by crafting a malicious JSON Web Encryption (JWE) token with a high compression ratio. This token, when processed by a server, leads to excessive memory allocation and processing time during decompression, causing a denial-of-service (DoS) condition.\n\nIt's important to note that the attacker must have access to the public encrypt key registered with the IDP(Entra ID) for successful exploitation.\n\n_According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?_\nA scope change (S:C) in the CVSS metric indicates that successful exploitation of this vulnerability could extend beyond the immediate processing of malicious tokens, affecting the overall availability of the system by causing a denial-of-service (DoS) condition.\n\n### Patches\nThe vulnerability has been fixed. Users should update **all** their Microsoft.IdentityModel versions to 7.1.2 (for 7x) or higher, 6.34.0 (for 6x) or higher, and 5.7.0 (for 5x).\n\n### Workarounds\nNo, users must upgrade.\n\n### References\nhttps://aka.ms/IdentityModel/Jan2024/zip", "aliases": [ { "alias": "GHSA-8g9c-28fc-mcx2" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/50186?format=api", "purl": "pkg:nuget/Microsoft.IdentityModel.JsonWebTokens@5.7.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.IdentityModel.JsonWebTokens@5.7.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/50187?format=api", "purl": "pkg:nuget/Microsoft.IdentityModel.JsonWebTokens@6.34.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.IdentityModel.JsonWebTokens@6.34.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/50189?format=api", "purl": "pkg:nuget/Microsoft.IdentityModel.JsonWebTokens@7.1.2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.IdentityModel.JsonWebTokens@7.1.2" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/62166?format=api", "purl": "pkg:nuget/Microsoft.IdentityModel.JsonWebTokens@6.5.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-34zm-8prm-abhs" }, { "vulnerability": "VCID-75q2-4q5c-fqf8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.IdentityModel.JsonWebTokens@6.5.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/62167?format=api", "purl": "pkg:nuget/Microsoft.IdentityModel.JsonWebTokens@7.0.0-preview", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-34zm-8prm-abhs" }, { "vulnerability": "VCID-75q2-4q5c-fqf8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/Microsoft.IdentityModel.JsonWebTokens@7.0.0-preview" }, { "url": "http://public2.vulnerablecode.io/api/packages/62171?format=api", "purl": "pkg:nuget/System.IdentityModel.Tokens.Jwt@6.5.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-34zm-8prm-abhs" }, { "vulnerability": "VCID-75q2-4q5c-fqf8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/System.IdentityModel.Tokens.Jwt@6.5.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/62172?format=api", "purl": "pkg:nuget/System.IdentityModel.Tokens.Jwt@7.0.0-preview", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-34zm-8prm-abhs" }, { "vulnerability": "VCID-75q2-4q5c-fqf8" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:nuget/System.IdentityModel.Tokens.Jwt@7.0.0-preview" } ], "references": [ { "reference_url": "https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet" }, { "reference_url": "https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/5.7.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/5.7.0" }, { "reference_url": "https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/6.34.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/6.34.0" }, { "reference_url": "https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/7.1.2", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/7.1.2" }, { "reference_url": "https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-8g9c-28fc-mcx2", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-8g9c-28fc-mcx2" }, { "reference_url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21319" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21319", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21319" }, { "reference_url": "https://github.com/advisories/GHSA-8g9c-28fc-mcx2", "reference_id": "GHSA-8g9c-28fc-mcx2", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-8g9c-28fc-mcx2" } ], "weaknesses": [ { "cwe_id": 20, "name": "Improper Input Validation", "description": "The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly." } ], "exploits": [], "severity_range_score": "4.0 - 6.9", "exploitability": "0.5", "weighted_severity": "6.2", "risk_score": 3.1, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-75q2-4q5c-fqf8" }