CVE-2023-37464

Incorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjose

8.6 HighFix available

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a version >= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm (e.g. AES CBC).

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.71%Up 0.7 points since Jul 15, 2023

What each source reports

CVE List Score used 8.6

Incorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjose

Record: CVE-2023-37464
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Weakness: CWE-327
Updated: 2026-11-02

EUVDEUVD-2023-41362 8.6

Record: EUVD-2023-41362
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Updated: 2026-11-03

NVD 8.6

Record: CVE-2023-37464
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-327
Updated: 2026-11-02

OSVALPINE-CVE-2023-37464 7.5

Record: ALPINE-CVE-2023-37464
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-03

OSVAZL-27659 7.5

CVE-2023-37464 affecting package cjose 0.6.1-6

Record: AZL-27659
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVAZL-36936 7.5

CVE-2023-37464 affecting package cjose for versions less than 0.6.2.2-7

Record: AZL-36936
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

Show 19 moreShow less

OSV 8.6

Incorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjose

Record: CVE-2023-37464
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Weakness: CWE-327
Updated: 2026-11-02

OSVDEBIAN-CVE-2023-37464 7.5

Record: DEBIAN-CVE-2023-37464
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVOESA-2023-1441 8.6

cjose security update

Implementation of JOSE for C/C++

Security Fix(es):

Record: OESA-2023-1441
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2023:4408 7.5

Red Hat Security Advisory: mod_auth_openidc:2.3 security update

Record: RHSA-2023:4408
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2023:4409 7.5

Red Hat Security Advisory: mod_auth_openidc:2.3 security update

Record: RHSA-2023:4409
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2023:4410 7.5

Red Hat Security Advisory: mod_auth_openidc:2.3 security update

Record: RHSA-2023:4410
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2023:4411 7.5

Red Hat Security Advisory: cjose security update

Record: RHSA-2023:4411
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2023:4417 7.5

Red Hat Security Advisory: cjose security update

Record: RHSA-2023:4417
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2023:4418 7.5

Red Hat Security Advisory: mod_auth_openidc:2.3 security update

Record: RHSA-2023:4418
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2023:4429 7.5

Red Hat Security Advisory: mod_auth_openidc:2.3 security update

Record: RHSA-2023:4429
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVRLSA-2023:4418 7.5

Important: mod_auth_openidc:2.3 security update

The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

Security Fix(es):

cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE (CVE-2023-37464)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2023:4418
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-37464 8.6

Record: UBUNTU-CVE-2023-37464
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVALSA-2023:4411 No score

Important: cjose security update

CJose is C library implementing the Javascript Object Signing and Encryption (JOSE).

Security Fix(es):

cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE (CVE-2023-37464)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2023:4411
Updated: 2026-11-02

OSVALSA-2023:4418 No score

Important: mod_auth_openidc:2.3 security update

Security Fix(es):

cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE (CVE-2023-37464)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2023:4418
Updated: 2026-11-02

OSVMGASA-2023-0350 No score

Updated cjose packages fix a security vulnerability

The updated packages fix a security vulnerability: The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated Authentication Tag and to modify the JWE accordingly. (CVE-2023-37464)

Record: MGASA-2023-0350
Updated: 2026-11-02

OSVopenSUSE-SU-2024:13052-1 No score

libcjose-devel-0.6.2.2-1.1 on GA media

These are all security issues fixed in the libcjose-devel-0.6.2.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:13052-1
Updated: 2026-11-02

OSVSUSE-SU-2023:3030-1 No score

Security update for cjose

This update for cjose fixes the following issues:

CVE-2023-37464: Fixed AES GCM decryption uses the Tag length from the actual Authentication Tag (bsc#1213385).

Record: SUSE-SU-2023:3030-1
Updated: 2026-11-02

OSVSUSE-SU-2023:3230-1 No score

Security update for cjose

This update for cjose fixes the following issues:

CVE-2023-37464: Fixed AES GCM decryption uses the Tag length from the actual Authentication Tag (bsc#1213385).

Record: SUSE-SU-2023:3230-1
Updated: 2026-11-02

OSVUSN-6307-1 No score

cjose vulnerability

It was discovered that JOSE for C/C++ AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. An attacker could use this to cause a denial of service (system crash) or might expose sensitive information.

Record: USN-6307-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`cjose` Alpine:v3.19	before 0.6.2.2-r0	0.6.2.2-r0
`cjose` Alpine:v3.20	before 0.6.2.2-r0	0.6.2.2-r0
`cjose` Alpine:v3.21	before 0.6.2.2-r0	0.6.2.2-r0
`cjose` Alpine:v3.22	before 0.6.2.2-r0	0.6.2.2-r0
`cjose` Alpine:v3.23	before 0.6.2.2-r0	0.6.2.2-r0
`cjose` Alpine:v3.24	before 0.6.2.2-r0	0.6.2.2-r0
`cjose` AlmaLinux:9	before 0.6.1-13.el9_2.alma	0.6.1-13.el9_2.alma
`cjose` AlmaLinux:8	before 0.6.1-3.module_el8.8.0+3591+c9939da8	0.6.1-3.module_el8.8.0+3591+c9939da8
`cjose-devel` AlmaLinux:8	before 0.6.1-3.module_el8.8.0+3591+c9939da8	0.6.1-3.module_el8.8.0+3591+c9939da8
`mod_auth_openidc` AlmaLinux:8	before 2.4.9.4-1.module_el8.7.0+3305+9a59f0c3	2.4.9.4-1.module_el8.7.0+3305+9a59f0c3

Show 118 moreShow less

Affected packages
Package	Affected	Fixed
`cjose` Azure Linux:2	through 0.6.1-6	None known
`cjose` Azure Linux:3	before 0.6.2.2-7	0.6.2.2-7
`cjose` Debian:12	before 0.6.2.1-1+deb12u1, plus listed versions 0.6.2.1-1	0.6.2.1-1+deb12u1
`cjose` Debian:13	before 0.6.2.2-1	0.6.2.2-1
`cjose` Debian:14	before 0.6.2.2-1	0.6.2.2-1
`cjose` Debian:10	before 0.6.1+dfsg1-1+deb10u1, plus listed versions 0.6.1+dfsg1-1	0.6.1+dfsg1-1+deb10u1
`cjose` Debian:11	before 0.6.1+dfsg1-1+deb11u1, plus listed versions 0.6.1+dfsg1-1	0.6.1+dfsg1-1+deb11u1
`cjose` Mageia:8	before 0.6.1-1.1.mga8	0.6.1-1.1.mga8
`cjose` Mageia:9	before 0.6.1-3.1.mga9	0.6.1-3.1.mga9
`cjose` openEuler:20.03-LTS-SP1	before 0.6.2.2-1.oe1	0.6.2.2-1.oe1
`cjose` openEuler:20.03-LTS-SP3	before 0.6.2.2-1.oe1	0.6.2.2-1.oe1
`cjose` openEuler:22.03-LTS	before 0.6.2.2-1.oe2203sp2	0.6.2.2-1.oe2203sp2
`cjose` openEuler:22.03-LTS-SP1	before 0.6.2.2-1.oe2203sp1	0.6.2.2-1.oe2203sp1
`cjose` openEuler:22.03-LTS-SP2	before 0.6.2.2-1.oe2203sp2	0.6.2.2-1.oe2203sp2
`cjose` Red Hat:rhel_eus:8.6::appstream	before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c	0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c
`cjose-debuginfo` Red Hat:rhel_eus:8.6::appstream	before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c	0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c
`cjose-debugsource` Red Hat:rhel_eus:8.6::appstream	before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c	0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c
`cjose-devel` Red Hat:rhel_eus:8.6::appstream	before 0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c	0:0.6.1-3.module+el8.6.0+19463+7d2e1f9c
`mod_auth_openidc` Red Hat:rhel_eus:8.6::appstream	before 0:2.3.7-11.module+el8.6.0+14082+b6f23e95	0:2.3.7-11.module+el8.6.0+14082+b6f23e95
`mod_auth_openidc-debuginfo` Red Hat:rhel_eus:8.6::appstream	before 0:2.3.7-11.module+el8.6.0+14082+b6f23e95	0:2.3.7-11.module+el8.6.0+14082+b6f23e95
`mod_auth_openidc-debugsource` Red Hat:rhel_eus:8.6::appstream	before 0:2.3.7-11.module+el8.6.0+14082+b6f23e95	0:2.3.7-11.module+el8.6.0+14082+b6f23e95
`cjose` Red Hat:rhel_aus:8.4::appstream	before 0:0.6.1-3.module+el8.4.0+19462+14bde120	0:0.6.1-3.module+el8.4.0+19462+14bde120
`cjose-debuginfo` Red Hat:rhel_aus:8.4::appstream	before 0:0.6.1-3.module+el8.4.0+19462+14bde120	0:0.6.1-3.module+el8.4.0+19462+14bde120
`cjose-debugsource` Red Hat:rhel_aus:8.4::appstream	before 0:0.6.1-3.module+el8.4.0+19462+14bde120	0:0.6.1-3.module+el8.4.0+19462+14bde120
`cjose-devel` Red Hat:rhel_aus:8.4::appstream	before 0:0.6.1-3.module+el8.4.0+19462+14bde120	0:0.6.1-3.module+el8.4.0+19462+14bde120
`mod_auth_openidc` Red Hat:rhel_aus:8.4::appstream	before 0:2.3.7-8.module+el8.4.0+9707+f2438af7	0:2.3.7-8.module+el8.4.0+9707+f2438af7
`mod_auth_openidc-debuginfo` Red Hat:rhel_aus:8.4::appstream	before 0:2.3.7-8.module+el8.4.0+9707+f2438af7	0:2.3.7-8.module+el8.4.0+9707+f2438af7
`mod_auth_openidc-debugsource` Red Hat:rhel_aus:8.4::appstream	before 0:2.3.7-8.module+el8.4.0+9707+f2438af7	0:2.3.7-8.module+el8.4.0+9707+f2438af7
`cjose` Red Hat:rhel_e4s:8.4::appstream	before 0:0.6.1-3.module+el8.4.0+19462+14bde120	0:0.6.1-3.module+el8.4.0+19462+14bde120
`cjose-debuginfo` Red Hat:rhel_e4s:8.4::appstream	before 0:0.6.1-3.module+el8.4.0+19462+14bde120	0:0.6.1-3.module+el8.4.0+19462+14bde120
`cjose-debugsource` Red Hat:rhel_e4s:8.4::appstream	before 0:0.6.1-3.module+el8.4.0+19462+14bde120	0:0.6.1-3.module+el8.4.0+19462+14bde120
`cjose-devel` Red Hat:rhel_e4s:8.4::appstream	before 0:0.6.1-3.module+el8.4.0+19462+14bde120	0:0.6.1-3.module+el8.4.0+19462+14bde120
`mod_auth_openidc` Red Hat:rhel_e4s:8.4::appstream	before 0:2.3.7-8.module+el8.4.0+9707+f2438af7	0:2.3.7-8.module+el8.4.0+9707+f2438af7
`mod_auth_openidc-debuginfo` Red Hat:rhel_e4s:8.4::appstream	before 0:2.3.7-8.module+el8.4.0+9707+f2438af7	0:2.3.7-8.module+el8.4.0+9707+f2438af7
`mod_auth_openidc-debugsource` Red Hat:rhel_e4s:8.4::appstream	before 0:2.3.7-8.module+el8.4.0+9707+f2438af7	0:2.3.7-8.module+el8.4.0+9707+f2438af7
`cjose` Red Hat:rhel_tus:8.4::appstream	before 0:0.6.1-3.module+el8.4.0+19462+14bde120	0:0.6.1-3.module+el8.4.0+19462+14bde120
`cjose-debuginfo` Red Hat:rhel_tus:8.4::appstream	before 0:0.6.1-3.module+el8.4.0+19462+14bde120	0:0.6.1-3.module+el8.4.0+19462+14bde120
`cjose-debugsource` Red Hat:rhel_tus:8.4::appstream	before 0:0.6.1-3.module+el8.4.0+19462+14bde120	0:0.6.1-3.module+el8.4.0+19462+14bde120
`cjose-devel` Red Hat:rhel_tus:8.4::appstream	before 0:0.6.1-3.module+el8.4.0+19462+14bde120	0:0.6.1-3.module+el8.4.0+19462+14bde120
`mod_auth_openidc` Red Hat:rhel_tus:8.4::appstream	before 0:2.3.7-8.module+el8.4.0+9707+f2438af7	0:2.3.7-8.module+el8.4.0+9707+f2438af7
`mod_auth_openidc-debuginfo` Red Hat:rhel_tus:8.4::appstream	before 0:2.3.7-8.module+el8.4.0+9707+f2438af7	0:2.3.7-8.module+el8.4.0+9707+f2438af7
`mod_auth_openidc-debugsource` Red Hat:rhel_tus:8.4::appstream	before 0:2.3.7-8.module+el8.4.0+9707+f2438af7	0:2.3.7-8.module+el8.4.0+9707+f2438af7
`cjose` Red Hat:rhel_aus:8.2::appstream	before 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee	0:0.6.1-3.module+el8.2.0+19461+3a40b6ee
`cjose-debuginfo` Red Hat:rhel_aus:8.2::appstream	before 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee	0:0.6.1-3.module+el8.2.0+19461+3a40b6ee
`cjose-debugsource` Red Hat:rhel_aus:8.2::appstream	before 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee	0:0.6.1-3.module+el8.2.0+19461+3a40b6ee
`cjose-devel` Red Hat:rhel_aus:8.2::appstream	before 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee	0:0.6.1-3.module+el8.2.0+19461+3a40b6ee
`mod_auth_openidc` Red Hat:rhel_aus:8.2::appstream	before 0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3	0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3
`mod_auth_openidc-debuginfo` Red Hat:rhel_aus:8.2::appstream	before 0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3	0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3
`mod_auth_openidc-debugsource` Red Hat:rhel_aus:8.2::appstream	before 0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3	0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3
`cjose` Red Hat:rhel_e4s:8.2::appstream	before 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee	0:0.6.1-3.module+el8.2.0+19461+3a40b6ee
`cjose-debuginfo` Red Hat:rhel_e4s:8.2::appstream	before 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee	0:0.6.1-3.module+el8.2.0+19461+3a40b6ee
`cjose-debugsource` Red Hat:rhel_e4s:8.2::appstream	before 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee	0:0.6.1-3.module+el8.2.0+19461+3a40b6ee
`cjose-devel` Red Hat:rhel_e4s:8.2::appstream	before 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee	0:0.6.1-3.module+el8.2.0+19461+3a40b6ee
`mod_auth_openidc` Red Hat:rhel_e4s:8.2::appstream	before 0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3	0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3
`mod_auth_openidc-debuginfo` Red Hat:rhel_e4s:8.2::appstream	before 0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3	0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3
`mod_auth_openidc-debugsource` Red Hat:rhel_e4s:8.2::appstream	before 0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3	0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3
`cjose` Red Hat:rhel_tus:8.2::appstream	before 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee	0:0.6.1-3.module+el8.2.0+19461+3a40b6ee
`cjose-debuginfo` Red Hat:rhel_tus:8.2::appstream	before 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee	0:0.6.1-3.module+el8.2.0+19461+3a40b6ee
`cjose-debugsource` Red Hat:rhel_tus:8.2::appstream	before 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee	0:0.6.1-3.module+el8.2.0+19461+3a40b6ee
`cjose-devel` Red Hat:rhel_tus:8.2::appstream	before 0:0.6.1-3.module+el8.2.0+19461+3a40b6ee	0:0.6.1-3.module+el8.2.0+19461+3a40b6ee
`mod_auth_openidc` Red Hat:rhel_tus:8.2::appstream	before 0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3	0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3
`mod_auth_openidc-debuginfo` Red Hat:rhel_tus:8.2::appstream	before 0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3	0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3
`mod_auth_openidc-debugsource` Red Hat:rhel_tus:8.2::appstream	before 0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3	0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3
`cjose` Red Hat:enterprise_linux:9::appstream	before 0:0.6.1-13.el9_2	0:0.6.1-13.el9_2
`cjose-debuginfo` Red Hat:enterprise_linux:9::appstream	before 0:0.6.1-13.el9_2	0:0.6.1-13.el9_2
`cjose-debugsource` Red Hat:enterprise_linux:9::appstream	before 0:0.6.1-13.el9_2	0:0.6.1-13.el9_2
`cjose` Red Hat:rhel_eus:9.0::appstream	before 0:0.6.1-13.el9_0	0:0.6.1-13.el9_0
`cjose-debuginfo` Red Hat:rhel_eus:9.0::appstream	before 0:0.6.1-13.el9_0	0:0.6.1-13.el9_0
`cjose-debugsource` Red Hat:rhel_eus:9.0::appstream	before 0:0.6.1-13.el9_0	0:0.6.1-13.el9_0
`cjose` Red Hat:enterprise_linux:8::appstream	before 0:0.6.1-3.module+el8.8.0+19464+578f4546	0:0.6.1-3.module+el8.8.0+19464+578f4546
`cjose-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:0.6.1-3.module+el8.8.0+19464+578f4546	0:0.6.1-3.module+el8.8.0+19464+578f4546
`cjose-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:0.6.1-3.module+el8.8.0+19464+578f4546	0:0.6.1-3.module+el8.8.0+19464+578f4546
`cjose-devel` Red Hat:enterprise_linux:8::appstream	before 0:0.6.1-3.module+el8.8.0+19464+578f4546	0:0.6.1-3.module+el8.8.0+19464+578f4546
`mod_auth_openidc` Red Hat:enterprise_linux:8::appstream	before 0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6	0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6
`mod_auth_openidc-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6	0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6
`mod_auth_openidc-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6	0:2.4.9.4-1.module+el8.7.0+14797+4085fcb6
`cjose` Red Hat:rhel_e4s:8.1::appstream	before 0:0.6.1-3.module+el8.1.0+19504+b2d26fa1	0:0.6.1-3.module+el8.1.0+19504+b2d26fa1
`cjose-debuginfo` Red Hat:rhel_e4s:8.1::appstream	before 0:0.6.1-3.module+el8.1.0+19504+b2d26fa1	0:0.6.1-3.module+el8.1.0+19504+b2d26fa1
`cjose-debugsource` Red Hat:rhel_e4s:8.1::appstream	before 0:0.6.1-3.module+el8.1.0+19504+b2d26fa1	0:0.6.1-3.module+el8.1.0+19504+b2d26fa1
`cjose-devel` Red Hat:rhel_e4s:8.1::appstream	before 0:0.6.1-3.module+el8.1.0+19504+b2d26fa1	0:0.6.1-3.module+el8.1.0+19504+b2d26fa1
`mod_auth_openidc` Red Hat:rhel_e4s:8.1::appstream	before 0:2.3.7-4.module+el8.1.0+19504+b2d26fa1.3	0:2.3.7-4.module+el8.1.0+19504+b2d26fa1.3
`mod_auth_openidc-debuginfo` Red Hat:rhel_e4s:8.1::appstream	before 0:2.3.7-4.module+el8.1.0+19504+b2d26fa1.3	0:2.3.7-4.module+el8.1.0+19504+b2d26fa1.3
`mod_auth_openidc-debugsource` Red Hat:rhel_e4s:8.1::appstream	before 0:2.3.7-4.module+el8.1.0+19504+b2d26fa1.3	0:2.3.7-4.module+el8.1.0+19504+b2d26fa1.3
`cjose` Rocky Linux:8	before 0:0.6.1-3.module+el8.8.0+1406+4a7f5371	0:0.6.1-3.module+el8.8.0+1406+4a7f5371
`mod_auth_openidc` Rocky Linux:8	before 0:2.4.9.4-1.module+el8.7.0+1061+55d14382	0:2.4.9.4-1.module+el8.7.0+1061+55d14382
`cjose` SUSE:OpenStack Cloud 9	before 0.6.1-7.5.1	0.6.1-7.5.1
`cjose` SUSE:OpenStack Cloud Crowbar 9	before 0.6.1-7.5.1	0.6.1-7.5.1
`cjose` SUSE:Linux Enterprise Server for SAP Applications 12 SP4	before 0.6.1-7.5.1	0.6.1-7.5.1
`cjose` SUSE:Linux Enterprise Server 12 SP4-ESPOS	before 0.6.1-7.5.1	0.6.1-7.5.1
`cjose` SUSE:Linux Enterprise Server 12 SP4-LTSS	before 0.6.1-7.5.1	0.6.1-7.5.1
`cjose` SUSE:Linux Enterprise Server 12 SP5	before 0.6.1-7.5.1	0.6.1-7.5.1
`cjose` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	before 0.6.1-7.5.1	0.6.1-7.5.1
`cjose` SUSE:Linux Enterprise Module for Server Applications 15 SP4	before 0.6.1-150100.4.6.1	0.6.1-150100.4.6.1
`cjose` SUSE:Linux Enterprise Module for Server Applications 15 SP5	before 0.6.1-150100.4.6.1	0.6.1-150100.4.6.1
`cjose` SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS	before 0.6.1-150100.4.6.1	0.6.1-150100.4.6.1
`cjose` SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS	before 0.6.1-150100.4.6.1	0.6.1-150100.4.6.1
`cjose` SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS	before 0.6.1-150100.4.6.1	0.6.1-150100.4.6.1
`cjose` SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS	before 0.6.1-150100.4.6.1	0.6.1-150100.4.6.1
`cjose` SUSE:Linux Enterprise Real Time 15 SP3	before 0.6.1-150100.4.6.1	0.6.1-150100.4.6.1
`cjose` SUSE:Linux Enterprise Server 15 SP1-LTSS	before 0.6.1-150100.4.6.1	0.6.1-150100.4.6.1
`cjose` SUSE:Linux Enterprise Server 15 SP2-LTSS	before 0.6.1-150100.4.6.1	0.6.1-150100.4.6.1
`cjose` SUSE:Linux Enterprise Server 15 SP3-LTSS	before 0.6.1-150100.4.6.1	0.6.1-150100.4.6.1
`cjose` SUSE:Linux Enterprise Server for SAP Applications 15 SP1	before 0.6.1-150100.4.6.1	0.6.1-150100.4.6.1
`cjose` SUSE:Linux Enterprise Server for SAP Applications 15 SP2	before 0.6.1-150100.4.6.1	0.6.1-150100.4.6.1
`cjose` SUSE:Linux Enterprise Server for SAP Applications 15 SP3	before 0.6.1-150100.4.6.1	0.6.1-150100.4.6.1
`cjose` SUSE:Manager Proxy 4.2	before 0.6.1-150100.4.6.1	0.6.1-150100.4.6.1
`cjose` SUSE:Manager Server 4.2	before 0.6.1-150100.4.6.1	0.6.1-150100.4.6.1
`cjose` SUSE:Enterprise Storage 7	before 0.6.1-150100.4.6.1	0.6.1-150100.4.6.1
`cjose` SUSE:Enterprise Storage 7.1	before 0.6.1-150100.4.6.1	0.6.1-150100.4.6.1
`cjose` openSUSE:Leap 15.4	before 0.6.1-150100.4.6.1	0.6.1-150100.4.6.1
`cjose` openSUSE:Leap 15.5	before 0.6.1-150100.4.6.1	0.6.1-150100.4.6.1
`cjose` Ubuntu:Pro:18.04:LTS	before 0.6.0+dfsg1-1ubuntu0.1~esm1, plus listed versions 0.4.1-3ubuntu10.5.1+dfsg1-10.5.1+dfsg1-20.5.1+dfsg1-2build10.6.0+dfsg1-1	0.6.0+dfsg1-1ubuntu0.1~esm1
`cjose` Ubuntu:20.04:LTS	before 0.6.1+dfsg1-1ubuntu0.1, plus listed versions 0.6.1+dfsg1-1	0.6.1+dfsg1-1ubuntu0.1
`cjose` Ubuntu:22.04:LTS	before 0.6.1+dfsg1-3ubuntu1.1, plus listed versions 0.6.1+dfsg1-10.6.1+dfsg1-30.6.1+dfsg1-3ubuntu1	0.6.1+dfsg1-3ubuntu1.1
`cjose` Ubuntu:24.04:LTS	All versions, plus listed versions 0.6.2.2-10.6.2.2-1build10.6.2.2-1build20.6.2.2-1build3	None known
`cjose` Ubuntu:25.10	All versions, plus listed versions 0.6.2.3-1	None known
`cjose` Ubuntu:26.10	All versions, plus listed versions 0.6.2.4-10.6.2.8-1	None known
`cjose` Ubuntu:26.04:LTS	All versions, plus listed versions 0.6.2.3-10.6.2.4-1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected, aliases, references	OSV
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-37464 is a high vulnerability (CVSS 8.6) in Cisco Cjose, published July 14, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.71%, the 53rd percentile. Fixed in cjose 0.6.2.2-r0.

References

Show 38 moreShow less