The version of cjose installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-37464 advisory.

  - OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM     decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE.
    The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to     provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a     version >= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with     another encryption algorithm (e.g. AES CBC). (CVE-2023-37464)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-2026_0017 advisory.

    This advisory aggregates security fixes for the cjose SRPM in CIQ LTS 8.6. It addresses 1 CVE:
    CVE-2023-37464.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM     decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE.
    The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to     provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a     version >= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with     another encryption algorithm (e.g. AES CBC). (CVE-2023-37464)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6307-1 advisory.

    It was discovered that JOSE for C/C++ AES GCM decryption routine incorrectly uses the Tag length from the     actual Authentication Tag provided in the JWE. An attacker could use this to cause a denial of service     (system crash) or might expose sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:4417 advisory.

    CJose is C library implementing the Javascript Object Signing and Encryption (JOSE).

    Security Fix(es):

    * cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE     (CVE-2023-37464)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-4418 advisory.

    - CVE-2023-37464 cjose: AES GCM decryption uses the Tag length from the actual       Authentication Tag provided in the JWE       Resolves: rhbz#2223308

    mod_auth_openidc

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0110 advisory.

    This advisory aggregates security fixes for the mod_auth_openidc SRPM in CIQ LTS 8.6. It addresses 6 CVEs:
    CVE-2021-39191, CVE-2021-32792, CVE-2019-14857, CVE-2019-20479, CVE-2021-32791, and 1 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4408 advisory.

    The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an     Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

    Security Fix(es):

    * cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE     (CVE-2023-37464)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:4418 advisory.

    * cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE     (CVE-2023-37464)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-4411 advisory.

    [0.6.1-13]
    - CVE-2023-37464 cjose: AES GCM decryption uses the Tag length from the actual       Authentication Tag provided in the JWE       Resolves: rhbz#2223308

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3515 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3515-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     August 04, 2023                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : cjose     Version        : 0.6.1+dfsg1-1+deb10u1     CVE ID         : CVE-2023-37464     Debian Bug     : 1041423

    An incorrect Authentication Tag length usage was discovered in cjose, a     C library implementing the Javascript Object Signing and Encryption     (JOSE) standard, which could lead to integrity compromise.

    The AES GCM decryption routine incorrectly uses the Tag length from the     actual Authentication Tag as provided in the JSON Web Encryption (JWE)     object, while the specification says that a fixed length of 16 octets     must be applied.  This could allows an attacker to provide a truncated     Authentication Tag and to modify the JWE accordingly.

    For Debian 10 buster, this problem has been fixed in version     0.6.1+dfsg1-1+deb10u1.

    We recommend that you upgrade your cjose packages.

    For the detailed security status of cjose please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/cjose

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2023:0091 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-37464:
    OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM     decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE.
    The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to     provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a     version >= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with     another encryption algorithm (e.g. AES CBC).

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6296:01 advisory.

    * cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE     (CVE-2023-37464)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2023-6285:01 advisory.

    * cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE     (CVE-2023-37464)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2023_4418 advisory.

    * cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE     (CVE-2023-37464)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
295732	Azure Linux 3.0 Security Update: cjose (CVE-2023-37464)	Nessus	Azure Linux Local Security Checks	2026/1/22	2026/1/22	high
357749	Rocky Linux 8.6 [CIQ] Security Update: cjose / cjose-debuginfo / cjose-debugsource / cjose-devel (ciqsa-2026_0017)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
251525	Linux Distros Unpatched Vulnerability : CVE-2023-37464	Nessus	Misc.	2025/8/18	2026/11/7	high
180187	Ubuntu 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 : JOSE for C/C++ vulnerability (USN-6307-1)	Nessus	Ubuntu Local Security Checks	2023/8/25	2024/8/27	high
179180	RHEL 9 : cjose (RHSA-2023:4417)	Nessus	Red Hat Local Security Checks	2023/8/1	2024/11/7	high
179242	Oracle Linux 8 : mod_auth_openidc:2.3 (ELSA-2023-4418)	Nessus	Oracle Linux Local Security Checks	2023/8/2	2025/9/9	high
356733	Rocky Linux 8.6 [CIQ] Security Update: mod_auth_openidc / mod_auth_openidc-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0110)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/11	high
179152	RHEL 8 : mod_auth_openidc:2.3 (RHSA-2023:4408)	Nessus	Red Hat Local Security Checks	2023/8/1	2024/11/7	high
179219	AlmaLinux 8 : mod_auth_openidc:2.3 (ALSA-2023:4418)	Nessus	Alma Linux Local Security Checks	2023/8/2	2025/1/13	high
179243	Oracle Linux 9 : cjose (ELSA-2023-4411)	Nessus	Oracle Linux Local Security Checks	2023/8/2	2025/9/9	high
179360	Debian dla-3515 : libcjose-dev - security update	Nessus	Debian Local Security Checks	2023/8/4	2025/1/22	high
236295	Alibaba Cloud Linux 3 : 0091: mod_auth_openidc:2.3 (ALINUX3-SA-2023:0091)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
292287	MiracleLinux 8 : mod_auth_openidc:2.3 (AXSA:2023-6296:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
293249	MiracleLinux 9 : cjose-0.6.1-13.el9 (AXSA:2023-6285:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
355533	Rocky Linux 8 [CIQ] Security Update: cjose / cjose-debuginfo / cjose-debugsource / cjose-devel / etc (crlsa-2023_4418)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high