Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.74 packages and security update

Red Hat OpenShift Container Platform release 4.14.74 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

CVE-2018-0114

CVE-2018-0114 Exploitation of a vulnerability in Cisco's node-jose, a JavaScript library created to manage JWT. This vulnerability in Cisco's node-jose allows an attacker to forge malicious tokens. JWT allows users to embed public keys using the jwk value inside the header of the token. However,...

POC-CVE-2018-0114

CVE-2018-0114 POC A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for JSON...

POC-CVE-2018-0114

POC-CVE-2018-0114 This repository contains the POC of an exploit for node-jose Stating from the last merge root@kitploit: python lib: base64,urllib,rsa,sys...

CVE-2018-0114

CVE-2018-0114 python2.7 script for JWT generation CVE-2018-0114 A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following...

CVE-2020-1472

Zerologon modified by Jose Maria Ferreira...

CVE-2018-0114

CVE-2018-0114 Exploit para Node-jose 0.11.0 escrito en Ruby Uso solo ingresa el nombre de la víctima en el código y ejecuta el archivo con ruby ./exploit.rb Una vulnerabilidad en la librería de código abierto node-jose de Cisco anterior a la versión 0.11.0 podría permitir que un atacante remoto n...

CVE-2018-0114-Exploit

CVE-2018-0114-Exploit A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.55 packages and security update

Red Hat OpenShift Container Platform release 4.18.55 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a...

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

CLEANSTART-2026-OX72086 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

Multiple security vulnerabilities affect the cloudprober-fips package. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. See references...

RHCOS 4 : OpenShift Container Platform 4.18.55 (RHSA-2026:66385)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:66385 advisory. - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 /etc/passwd Injection via HOME env CVE-2026-15809 -...

RHCOS 4 : OpenShift Container Platform 4.12.98 (RHSA-2026:65906)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:65906 advisory. - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 /etc/passwd Injection via HOME env CVE-2026-15809 -...

[SECURITY] [DSA 6499-1] cjose security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6499-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 15, 2026 https://www.debian.org/security/faq -...

Astra Linux – Vulnerability in erlang-jose

In versions 1.11.6 and earlier of erlang-jose also known as JOSE for Erlang and Elixir, attackers can exploit this vulnerability to cause a denial of service attack, resulting in high CPU usage. This vulnerability stems from a large p2c value in the JOSE header...

Astra Linux – Vulnerability in Jose

Latchset JOSE with version 11 allows attackers to cause a denial of service CPU consumption by using a large p2c value also known as PBES2 Count...

CVE-2026-89086

In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS 1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key...