214 matches found
ALSA-2026:92157 Critical: mod_auth_openidc:2.3 security update
The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE...
Critical: mod_auth_openidc:2.3 security update
The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE...
cjose security update
0.6.1-17.1 - CVE-2026-53938 cjose: heap buffer overflow in AES key unwrap Resolves: RHEL-256972...
Important: cjose security update
CJose is C library implementing the Javascript Object Signing and Encryption JOSE. Security Fixes: cjose: cjose: Heap buffer overflow in AES Key Wrap decryption leads to denial of service CVE-2026-53938 For more details about the security issues, including the impact, a CVSS score, acknowledgment...
FreeBSD : cjose -- Heap-based Buffer Overflow (35b3a492-b05a-11f1-9369-b42e991fc52e)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 35b3a492-b05a-11f1-9369-b42e991fc52e advisory. https://github.com/OpenIDC/cjose/security/advisories/GHSA-75r7-f5cv-g3wj reports: OpenIDC/cjose is a C...
CLSA-2026-1792632603 cjose: Fix of CVE-2026-53939
CVE-2026-53939: fix all-zero AES-CBC-HMAC content-encryption key...
AlmaLinux 9.6 [TuxCare] Security Update: cjose / cjose-devel (ALMALINUX9.6:CLSA-2026:1792632603)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792632603 advisory. - OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose...
Rocky Linux 9.6 [TuxCare] Security Update: cjose / cjose-devel (ALMALINUX9.6:CLSA-2026:1792632603)
The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792632603 advisory. - OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjos...
RockyLinux 10 : cjose (RLSA-2026:80605)
The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:80605 advisory. cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption CVE-2026-53939 Tenable has extracted the preceding description block...
Oracle Linux 8 : mod_auth_openidc:2.3 (ELSA-2026-77369)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-77369 advisory. - CVE-2026-53938 cjose: heap buffer overflow in AES key unwrap Resolves: RHEL-256961 modauthopenidc Tenable has extracted the preceding description...
RHEL 10 : cjose (RHSA-2026:80605)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:80605 advisory. CJose is C library implementing the Javascript Object Signing and Encryption JOSE. Security Fixes: cjose: OpenIDC/cjose uses all-zero Content...
MiracleLinux 8 : mod_auth_openidc:2.3 (AXSA:2026-2061:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2061:01 advisory. modauthopenidc: modauthopenidc: Denial of Service via malformed state cookie parsing CVE-2026-54789 cjose: cjose: Heap buffer overflow in AES Key Wr...
Critical: Red Hat Security Advisory: cjose security update
An update for cjose is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption
A flaw was found in cjose. When encrypting a JSON Web Encryption JWE object using AES-CBC-HMAC algorithms, the library initializes the encryption key with all-zero bytes instead of generating a secure random key. As a result, an attacker who intercepts the encrypted message can decrypt sensitive...
RHEL 10 : cjose (RHSA-2026:83224)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83224 advisory. CJose is C library implementing the Javascript Object Signing and Encryption JOSE. Security Fixes: cjose: OpenIDC/cjose uses all-zero Content...
Rocky Linux 10.2 [CIQ] Security Update: cjose / cjose-debuginfo / cjose-debugsource / cjose-devel (crlsa-2026_80605)
The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202680605 advisory. cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption CVE-2026-53939 Tenable has extracted the preceding description block...
AlmaLinux 8 : mod_auth_openidc:2.3 (ALSA-2026:77369)
The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:77369 advisory. modauthopenidc: modauthopenidc: Denial of Service via malformed state cookie parsing CVE-2026-54789 cjose: cjose: Heap buffer overflow in AES Key Wrap...
RLSA-2026:80605 Critical: cjose security update
CJose is C library implementing the Javascript Object Signing and Encryption JOSE. Security Fixes: cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption CVE-2026-53939 For more details about the security issues, including the impact, a CVSS score,...
cjose security update
An update is available for cjose. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list CJose is C library implementing the Javascript Object Signing and Encryption...
Updated cjose packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Heap buffer overflow in AES Key Wrap decryption A128KW/A192KW/A256KW. CVE-2026-53938 All-zero Content Encryption Key used for AES-CBC-HMAC JWE encryption. CVE-2026-53939...