cjsse v0.6.2.6 fixes JWE/JWS key handling & signature validation CVEs

Security Update Summary for OpenJDK cjsse Version 0.6.2.6 Vulnerability Overview AES-CBC-HMAC Encryption Key Issue: AES-CBC-HMAC JWE encryption must use a random content encryption key, rather than an all-zero content encryption key (see security advisory ). Insufficient HMAC Key Length in JWS Signature Verification: Enforces the minimum HMAC key length specified in RFC 7518 ( ), which means symmetric keys (such as HS256) must be greater than 32 characters. NULL Pointer Dereference on ECDSA Authentication Tag Failure: Fixed NULL dereferences in , , and . Multi-Recipient CEK Key Check: Implements constant-time comparison for multi-recipient CEK key checks. Private Key Material Cleanup During JWK Import/Export: Cleans up RSA/EC private key material and fixes a dereference issue in the base64 buffer based on EC private keys. EC Key Export Check: Validates elliptic curve allocation during EC key export. ECDSA Arithmetic Optimization: Uses integer arithmetic (instead of floating-point) for base64url length checks. Hardening of JWS EC Signature Reconstruction: Performs NULL checks on imported JWK fields ( and ) to harden JWS EC signature reconstruction. Impact Scope Affects the JWE/JWS encryption and signing functions of the library, involving modules such as AES-CBC-HMAC, HS256, ECDSA, and RSA/EC key handling. Applicable to applications using for encryption/decryption and signature verification of JSON Web Tokens (JWT). Resolution Upgrade to v0.6.2.6 (released by zandbelt on June 2). This version fixes all the security defects listed above. POC / Signature Key Code Block The RPM package for this version is signed using the following RSA PGP key: ``` -----BEGIN PGP PUBLIC KEY BLOCK----- mQENB05G1qRCACDycXnfrE50SrLlF02fP1z/2zvQXK6xT5xNpU8/1D8vXbX YX9/Syp2H/y281Dqg1e928Ab/Ry56t6C6cGdUfUDQ0vNwY58qY7vLLwM WLS9pF7M9C6A629v1z2n/49ybT8C2cUcU5cDZmY51w3w1z2n/100p1QpTQ X0p1QpTQ25F5KXK7AQJQJQVCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL GCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCLGCL

Goal Reached Thanks to every supporter — we hit 100%!

cjsse v0.6.2.6 fixes JWE/JWS key handling & signature validation CVEs

More from this source