Duplicate Advisory: Microsoft Identity Denial of service vulnerability
Duplicate AdvisoryThis advisory has been withdrawn because it is a duplicate of GHSA-59j7-ghrg-fj52. This link is maintained to preserve external references.Original DescriptionImpactAn attacker could exploit this vulnerability by crafting a malicious JSON Web Encryption (JWE) token with a high compression ratio. This token, when processed by a server, leads to excessive memory allocation and processing time during decompression, causing a denial-of-service (DoS) condition.It's important to note that the attacker must have access to the public encrypt key registered with the IDP(Entra ID) for successful exploitation._According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?_
A scope change (S:C) in the CVSS metric indicates that successful exploitation of this vulnerability could extend beyond the immediate processing of malicious tokens, affecting the overall availability of the system by causing a denial-of-service (DoS) condition.PatchesThe vulnerability has been fixed. Users should update **all** their Microsoft.IdentityModel versions to 7.1.2 (for 7x) or higher, 6.34.0 (for 6x) or higher, and 5.7.0 (for 5x).WorkaroundsNo, users must upgrade.Referenceshttps://aka.ms/IdentityModel/Jan2024/zip