Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2026-53939

critical

CVE-2026-53939

cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption

Published Modified CWE 321, 330
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

Red Hat9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Trivy's own label is CRITICAL. Rated critical by Red Hat, AlmaLinux, Oracle, Rocky Linux. Rated lower by Amazon (high).

Description

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm (`A128CBC-HS256`, `A192CBC-HS384`, or `A256CBC-HS512`) together with any key-management algorithm that generates a fresh content-encryption key (CEK), the CEK is all zero bytes instead of being randomly generated. The resulting JWE is therefore encrypted and authenticated under a fixed, publicly known key, so anyone who obtains the JWE can recover the plaintext and forge or modify the content. This is fixed in version 0.6.2.6 by `_cjose_jwe_set_cek_aes_cbc()` generating the CEK from `RAND_bytes`. A regression test asserts that the `encrypted_key` differs across two encryptions for each AES-CBC-HMAC variant. Until upgrading, for data encrypted with cjose, three options are available. Use an AES-GCM `enc` (`A128GCM` / `A192GCM` / `A256GCM`) instead of an AES-CBC-HMAC `enc`, use `alg=dir` with a caller-supplied CEK, or avoid using cjose for JWE encryption with the affected algorithm pair. These are mitigations for new ciphertexts only; data already encrypted under the zero key remains compromised and should be re-encrypted (and any secrets it contained rotated).

Affected packages and fixed versions

SourcePackageFixed in
alma 10cjose, cjose-devel0.6.2.2-7.el10_2.2
Red Hatcjose, mod_auth_openidc:2.3::cjose, mod_auth_openidc:2.3::cjose-develno fix listed
rocky 10cjose0.6.2.2-7.el10_2.2
amazon linux 2023cjose, cjose-debuginfo, cjose-debugsource and 1 more0.6.2.2-7.amzn2023
debian 11cjoseno fix listed
debian 12cjoseno fix listed
debian 13cjose0.6.2.3-1+deb13u1
debian 14cjose0.6.2.7-1
echocjose0.6.2.3-1+deb13u1
rapidfort alma 10cjose, cjose-devel0.6.2.2-7.el10_2.2, 0:0.6.2.2-7.el10_0.2
rapidfort alma 9cjoseno fix listed
rapidfort amazon linux 2023cjose, cjose-devel0.6.2.2-7.amzn2023
Show all 26 entries from 18 sources
SourcePackageFixed in
alma 10cjose0.6.2.2-7.el10_2.2
alma 10cjose-devel0.6.2.2-7.el10_2.2
Red Hatcjoseno fix listed
Red Hatmod_auth_openidc:2.3::cjoseno fix listed
Red Hatmod_auth_openidc:2.3::cjose-develno fix listed
rocky 10cjose0.6.2.2-7.el10_2.2
amazon linux 2023cjose0.6.2.2-7.amzn2023
amazon linux 2023cjose-debuginfo0.6.2.2-7.amzn2023
amazon linux 2023cjose-debugsource0.6.2.2-7.amzn2023
amazon linux 2023cjose-devel0.6.2.2-7.amzn2023
debian 11cjoseno fix listed
debian 12cjoseno fix listed
debian 13cjose0.6.2.3-1+deb13u1
debian 14cjose0.6.2.7-1
echocjose0.6.2.3-1+deb13u1
rapidfort alma 10cjose0.6.2.2-7.el10_2.2, 0:0.6.2.2-7.el10_0.2
rapidfort alma 10cjose-devel0.6.2.2-7.el10_2.2, 0:0.6.2.2-7.el10_0.2
rapidfort alma 9cjoseno fix listed
rapidfort amazon linux 2023cjose0.6.2.2-7.amzn2023
rapidfort amazon linux 2023cjose-devel0.6.2.2-7.amzn2023
rapidfort debian 12cjose0:0.6.2.3-1+deb13u1, 0:0.6.2.7-1
rapidfort debian 13cjose0:0.6.2.3-1+deb13u1, 0:0.6.2.7-1
rapidfort Oracle Linux 10cjose0:0.6.2.2-7.el10_2.2
rapidfort Oracle Linux 9cjoseno fix listed
rapidfort Red Hat 9cjoseno fix listed
rapidfort rocky 9cjoseno fix listed

References

All 15 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.