PT-2025-29195

Name of the Vulnerable Software and Affected Versions: Connect2id Nimbus JOSE + JWT versions prior to 10.0.2 Description: The software is susceptible to a denial-of-service condition triggered by a deeply nested JSON object within a JWT claim set. This occurs due to uncontrolled recursion during...

CVE-2025-53864

Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2i...

CVE-2023-50967 affecting package jose for versions less than 14-3

CVE-2023-50967 affecting package jose for versions less than 14-3. An upgraded version of the package is available that resolves this issue...

CLSA-2025-1752088672 buildah: Fix of CVE-2025-27144

CVE-2025-27144: fix vulnerability in go-jose dependency...

CVE-2025-28993

Improper Control of Generation of Code 'Code Injection' vulnerability in Jose Mortellaro Content No Cache content-no-cache allows Code Injection.This issue affects Content No Cache: from n/a through = 0.1.4...

OESA-2025-1687 skopeo security update

A command line utility that performs various operations on container images and image repositories Security Fixes: Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used lar...

CVE-2025-28993

Improper Control of Generation of Code 'Code Injection' vulnerability in Jose Mortellaro Content No Cache content-no-cache allows Code Injection.This issue affects Content No Cache: from n/a through = 0.1.4...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to CVE-2025-27144 in different components

Summary Go is used by IBM Storage Fusion Data Foundation in csi-dirver, odf-cli-container, ocs-operator-container, msc-operator-container, odf-multicluster-operator-container, rook-ceph-operator and ocs-metrics-exporter-container as part of CVE-2025-27144. This bulletin identifies the steps to ta...

ROS-20250624-15

Vulnerability in the Javascript Object Signing and Encryption Go JOSE standards set implementation is related to uncontrolled consumption of internal resources properly when analyzing JWS and JWE input data. Exploitation of the vulnerability could allow an attacker acting remotely to cause a deni...

glibc security update

2.28-251.0.3.22 - Forward port of Oracle patches Reviewed-by: David Faust Oracle history: April-14-2025 Cupertino Miranda - 2.28-251.0.3.16 - Forward port of Oracle patches Reviewed-by: Elena Zannoni March-26-2025 Cupertino Miranda - 2.28-251.0.3.14 - OraBug: 36625686 Add MTE support on string...

Advisory ROSA-SA-2025-2888

Software: jose 10 OS: ROSA Virtualization 3.0 packageevrstring: jose-10-2.rv30.3 CVE-ID: CVE-2023-50967 BDU-ID: 2024-02461 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the C language module for signing and encrypting JSON latchset Jose objects is associated with uncontrolled resource consumption...

Advisory ROSA-SA-2025-2878

Software: jose 10 OS: ROSA Virtualization 2.1 packageevrstring: jose-10-2.rv3.3 CVE-ID: CVE-2023-50967 BDU-ID: 2024-02461 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the C language module for signing and encrypting JSON latchset Jose objects is associated with uncontrolled resource consumption...

RHEL 10 : skopeo (RHSA-2025:7467)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7467 advisory. The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify...

SUSE-SU-2025:20363-1 Security update for skopeo

This update for skopeo fixes the following issues: - CVE-2024-6104: url might write sensitive information to log file bsc1227056. - CVE-2023-45288: close connections when receiving too many headers bsc1236483. - CVE-2025-27144: Go JOSE's Parsing Vulnerable to Denial of Service bsc1237613...

Security update for skopeo

This update for skopeo fixes the following issues: CVE-2024-6104: url might write sensitive information to log file bsc1227056. CVE-2023-45288: close connections when receiving too many headers bsc1236483. CVE-2025-27144: Go JOSE's Parsing Vulnerable to Denial of Service bsc1237613. Patch...

RHEL 9 : skopeo (RHSA-2025:7397)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7397 advisory. The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify file...

CVE-2023-44239

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Jobin Jose WWM Social Share On Image Hover plugin = 2.2 versions...

CVE-2023-23928

reason-jose is a JOSE implementation in ReasonML and OCaml.Jose.Jws.validate does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks. Such tampering could expose applications using reason-jose to authorization bypass...

CVE-2022-36083

JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c PBES2 Count, which determine...

CVE-2021-29443

jose is an npm library providing a number of cryptographic operations. In vulnerable versions AESCBCHMACSHA2 Algorithm A128CBC-HS256, A192CBC-HS384, A256CBC-HS512 decryption would always execute both HMAC tag verification and CBC decryption, if either failed JWEDecryptionFailed would be thrown. A...