Update Changes

lestrrat-go · Dec 3, 2023 · fa436a3 · fa436a3
1 parent 0535c19
commit fa436a3
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/Changes b/Changes
@@ -2,7 +2,13 @@ Changes
 =======
 
 v1.2.27 - UNRELEASED
-[Buf xies]
+[Security]
+  * [jwe] A large number in p2c parameter for PBKDF2 based encryptions could cause a DoS attack,
+    similar to https://nvd.nist.gov/vuln/detail/CVE-2022-36083.  All users should upgrade, as
+    unlike v2, v1 attempts to decrypt JWEs on JWTs by default.
+    [GHSA-7f9x-gw85-8grf]
+
+[Bug xies]
   * [jwk] jwk.Set(jwk.KeyOpsKey, <jwk.KeyOperation>) now works (previously, either
      Set(.., <string>) or Set(..., []jwk.KeyOperation{...}) worked, but not a single
      jwk.KeyOperation