Every CVE Search/ Get API key

CVE-2023-50967

latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption)...

7.5 HighFix available

latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.38%Up 1.3 points since Mar 21, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.5

latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

Record
CVE-2023-50967
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
EUVDEUVD-2023-55695 7.5

latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

Record
EUVD-2023-55695
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-5rrv-52wj-qgfg 7.5

latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption)...

latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

Record
GHSA-5rrv-52wj-qgfg
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
NVD 7.5

latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

Record
CVE-2023-50967
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSV 7.5

latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

Record
CVE-2023-50967
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2023-50967 7.5

latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

Record
DEBIAN-CVE-2023-50967
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 12 moreShow less
OSVOESA-2024-1440 7.5

jose security update

José is a C-language implementation of the Javascript Object Signing and Encryption standards. José provides a command-line utility which encompasses most of the JOSE features. This allows for easy integration into your project and one-off scripts.

Security Fix(es):

latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.(CVE-2023-50967)

Record
OESA-2024-1440
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-1471 7.5

jose security update

José is a C-language implementation of the Javascript Object Signing and Encryption standards. José provides a command-line utility which encompasses most of the JOSE features. This allows for easy integration into your project and one-off scripts.

Security Fix(es):

latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.(CVE-2023-50967)

Record
OESA-2024-1471
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:5294 7.5

Red Hat Security Advisory: jose security update

Record
RHSA-2024:5294
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:9181 7.5

Red Hat Security Advisory: jose security update

Record
RHSA-2024:9181
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2024:5294 7.5

Moderate: jose security update

Jose is a C-language implementation of the Javascript Object Signing and Encryption standards. The jose package is a dependency of the clevis and tang packages, together providing Network Bound Disk Encryption (NBDE) in Rocky Linux.

Security Fix(es):

  • jose: resource exhaustion (CVE-2024-28176)

  • jose: Denial of service due to uncontrolled CPU consumption (CVE-2023-50967)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2024:5294
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2024:9181 7.5

Moderate: jose security update

Jose is a C-language implementation of the Javascript Object Signing and Encryption standards. The jose package is a dependency of the clevis and tang packages, together providing Network Bound Disk Encryption (NBDE) in Rocky Linux.

Security Fix(es):

  • jose: resource exhaustion (CVE-2024-28176)

  • jose: Denial of service due to uncontrolled CPU consumption (CVE-2023-50967)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.

Record
RLSA-2024:9181
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-50967 7.5

latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

Record
UBUNTU-CVE-2023-50967
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2024:5294 No score

Moderate: jose security update

Jose is a C-language implementation of the Javascript Object Signing and Encryption standards. The jose package is a dependency of the clevis and tang packages, together providing Network Bound Disk Encryption (NBDE) in AlmaLinux.

Security Fix(es):

  • jose: resource exhaustion (CVE-2024-28176)
  • jose: Denial of service due to uncontrolled CPU consumption (CVE-2023-50967)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2024:5294
Updated
2026-11-02
OSVALSA-2024:9181 No score

Moderate: jose security update

Jose is a C-language implementation of the Javascript Object Signing and Encryption standards. The jose package is a dependency of the clevis and tang packages, together providing Network Bound Disk Encryption (NBDE) in AlmaLinux.

Security Fix(es):

  • jose: resource exhaustion (CVE-2024-28176)
  • jose: Denial of service due to uncontrolled CPU consumption (CVE-2023-50967)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2024:9181
Updated
2026-11-02
OSVAZL-43528 No score

CVE-2023-50967 affecting package jose 10-7

latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

Record
AZL-43528
Updated
2026-11-02
OSVAZL-45135 No score

CVE-2023-50967 affecting package jose for versions less than 14-3

latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

Record
AZL-45135
Updated
2026-11-02
OSVCLSA-2025-1751893277 No score

jose: Fix of CVE-2023-50967

  • CVE-2023-50967: fix denial of service issue caused by large p2c value
Record
CLSA-2025-1751893277
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
jose
AlmaLinux:8
From an advisory covering 2 CVEs
 before 10-2.el8_10.3
10-2.el8_10.3
libjose
AlmaLinux:8
From an advisory covering 2 CVEs
 before 10-2.el8_10.3
10-2.el8_10.3
libjose-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 10-2.el8_10.3
10-2.el8_10.3
jose
AlmaLinux:9
From an advisory covering 2 CVEs
 before 14-1.el9
14-1.el9
libjose
AlmaLinux:9
From an advisory covering 2 CVEs
 before 14-1.el9
14-1.el9
libjose-devel
AlmaLinux:9
From an advisory covering 2 CVEs
 before 14-1.el9
14-1.el9
jose
Azure Linux:2
 through 10-7 None known
jose
Azure Linux:3
 before 14-3
14-3
jose
TuxCare:AlmaLinux:9.2
 before 11-3.el9.tuxcare.els1
11-3.el9.tuxcare.els1
libjose
TuxCare:AlmaLinux:9.2
 before 11-3.el9.tuxcare.els1
11-3.el9.tuxcare.els1
Show 34 moreShow less
Affected packages
PackageAffectedFixed
libjose-devel
TuxCare:AlmaLinux:9.2
 before 11-3.el9.tuxcare.els1
11-3.el9.tuxcare.els1
jose
Debian:12
 before 11-2+deb12u1, plus listed versions
11-2
11-2+deb12u1
jose
Debian:13
 before 13-1
13-1
jose
Debian:14
 before 13-1
13-1
jose
openEuler:20.03-LTS-SP1
 before 10-7.oe1
10-7.oe1
jose
openEuler:20.03-LTS-SP4
 before 10-7.oe2003sp4
10-7.oe2003sp4
jose
openEuler:22.03-LTS
 before 11-2.oe2203sp3
11-2.oe2203sp3
jose
openEuler:22.03-LTS-SP2
 before 11-2.oe2203sp2
11-2.oe2203sp2
jose
openEuler:22.03-LTS-SP3
 before 11-2.oe2203sp3
11-2.oe2203sp3
jose
openEuler:22.03-LTS-SP1
 before 11-2.oe2203sp1
11-2.oe2203sp1
jose
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10-2.el8_10.3
0:10-2.el8_10.3
jose-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10-2.el8_10.3
0:10-2.el8_10.3
jose-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10-2.el8_10.3
0:10-2.el8_10.3
libjose
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10-2.el8_10.3
0:10-2.el8_10.3
libjose-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10-2.el8_10.3
0:10-2.el8_10.3
libjose-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:10-2.el8_10.3
0:10-2.el8_10.3
jose
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:14-1.el9
0:14-1.el9
jose-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:14-1.el9
0:14-1.el9
jose-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:14-1.el9
0:14-1.el9
libjose
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:14-1.el9
0:14-1.el9
libjose-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:14-1.el9
0:14-1.el9
jose-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 2 CVEs
 before 0:14-1.el9
0:14-1.el9
jose-debugsource
Red Hat:enterprise_linux:9::crb
From an advisory covering 2 CVEs
 before 0:14-1.el9
0:14-1.el9
libjose-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 2 CVEs
 before 0:14-1.el9
0:14-1.el9
libjose-devel
Red Hat:enterprise_linux:9::crb
From an advisory covering 2 CVEs
 before 0:14-1.el9
0:14-1.el9
jose
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:10-2.el8_10.3
0:10-2.el8_10.3
jose
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:14-1.el9
0:14-1.el9
jose
Ubuntu:18.04:LTS
 All versions, plus listed versions
10-210-2build1
 None known
jose
Ubuntu:20.04:LTS
 All versions, plus listed versions
10-2build2
 None known
jose
Ubuntu:22.04:LTS
 All versions, plus listed versions
10-311-2
 None known
jose
Ubuntu:24.04:LTS
 All versions, plus listed versions
11-211-311-3build111-3build213-1
 None known
jose
Ubuntu:25.10
 All versions, plus listed versions
14-114-214-2build1
 None known
jose
Ubuntu:26.10
 All versions, plus listed versions
14-2build114-2build2
 None known
jose
Ubuntu:26.04:LTS
 All versions, plus listed versions
14-2build1
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-50967 is a high vulnerability (CVSS 7.5) in Latchset Jose, published March 20, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.38%, the 72nd percentile. Fixed in jose 14-3.

References

Show 31 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open