What’s Vulnerable › Vulnerabilities

CVE-2023-50967

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-03-20 · updated 2026-06-17
• Weakness: CWE-400

Description

latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

Affected products

• Fedoraproject Fedora: 38, 39, 40
• latchset Jose: through 11

References

• https://github.com/P3ngu1nW/CVE_Request/blob/main/latch-jose.md
• https://github.com/latchset/jose
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CIFPQUCLNWEAHYYJWCQD3AZPWYIV6YT3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OOBFVMOAV732C7PY74AHJ62ZNKT3ISZ6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W7EGLOAFN2PWZ75ZRLTUDUZCIPH2VFZU/
• https://github.com/P3ngu1nW/CVE_Request/blob/main/latch-jose.md
• https://github.com/latchset/jose
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CIFPQUCLNWEAHYYJWCQD3AZPWYIV6YT3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OOBFVMOAV732C7PY74AHJ62ZNKT3ISZ6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W7EGLOAFN2PWZ75ZRLTUDUZCIPH2VFZU/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CIFPQUCLNWEAHYYJWCQD3AZPWYIV6YT3/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OOBFVMOAV732C7PY74AHJ62ZNKT3ISZ6/

Get alerted when CVE-2023-50967 or the next vulnerability affects your stack