INFSA-2024:3267: idm:DL1 and idm:client security update

Information about definition

Identificator: INFSA-2024:3267

Type: security

Release date: 2024-10-10 05:59:10 UTC

Information about package

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Vulnerabilities description

  • CVE-2023-6681

    A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue can result in a large amount of computational consumption, causing a denial of service attack.

  • CVE-2024-28102

    JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time. Version 1.5.6 fixes this vulnerability by limiting the maximum token length.

Severity level

CVE Score CVSS 2.0 Score CVSS 3.x Score CVSS 4.0
NIST — CVE-2023-6681
 no information 5.3 no information
no information 6.8 no information
Critical, important, moderate, low

Updated packages