jose Security Vulnerabilities

jose is a JavaScript module for signing and encrypting JSON objects. A security vulnerability exists in jose versions prior to 2.0.7 and 4.15.5 that could allow an attacker to exhaust resources via a specially crafted JWE with compressed plaintext...

jose Security Vulnerabilities

jose is a JavaScript module for signing and encrypting JSON objects. A security vulnerability exists in jose versions prior to 4.0.1, 3.0.3, and 2.6.3, which allows an attacker to send JWEs containing compressed data that uses a large amount of memory and CPU when decompressed via Decrypt or...

GHSA-HJ3V-M684-V259 JWX vulnerable to a denial of service attack using compressed JWE message

Summary This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service DoS condition by crafting a malicious JSON Web Encryption JWE token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory...

Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

Impact An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size whichever is larger. Thanks to Enze...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification. An attacker could send a JWE containing compressed data that, when decompressed by Decrypt or DecryptMulti, would use large amounts of memory and CPU. Remediation There is ...

[SECURITY] Fedora 40 Update: nom-tam-fits-1.15.2-22.fc40

FITS Flexible Image Transport System is the standard data format in astronomy used for the transport, analysis, and archival storage of scientific data sets. This library provides efficient I/O for FITS images and binary tables. All basic FITS formats and GZIP compressed files are supported...

PT-2024-2050

Name of the Vulnerable Software and Affected Versions go-jose versions prior to 2.6.3 go-jose versions prior to 3.0.3 go-jose versions prior to 4.0.1 Description The issue is related to the incorrect handling of highly compressed input data in the go-jose package, which implements the Javascript...

CVE-2024-28101 Apollo Router's Compressed Payloads do not respect HTTP Payload Limits

The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service DoS type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the...

BIT-PILLOW-2022-45198

Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data Data Amplification...

BIT-GOLANG-2022-30631 Stack exhaustion when reading certain archives in compress/gzip

Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files...

PT-2024-22266

Name of the Vulnerable Software and Affected Versions Apollo Router versions 0.9.5 through 1.40.2 Description The Apollo Router is subject to a Denial-of-Service DoS type issue. When receiving compressed HTTP payloads, affected versions of the Router evaluate the limits.http max request bytes...

The vulnerability of the f2fs_write_compressed_pages() function in the fs/f2fs/compress.c module of the Linux kernel’s file system f2fs allows a hacker to cause a service failure.

The vulnerability of the f2fswritecompressedpages function in the fs/f2fs/compress.c module of the Linux kernel’s file system f2fs is related to improper cleanup or release of resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2023-52526

In the Linux kernel, the following vulnerability has been resolved: erofs: fix memory leak of LZMA global compressed deduplication When stressing microLZMA EROFS images with the new global compressed deduplication feature enabled -Ededupe, I found some short-lived temporary pages weren't properly...

Spoofing

In the Linux kernel, the following vulnerability has been resolved: erofs: fix memory leak of LZMA global compressed deduplication When stressing microLZMA EROFS images with the new global compressed deduplication feature enabled -Ededupe, I found some short-lived temporary pages weren't properly...

CVE-2023-52526 erofs: fix memory leak of LZMA global compressed deduplication

In the Linux kernel, the following vulnerability has been resolved: erofs: fix memory leak of LZMA global compressed deduplication When stressing microLZMA EROFS images with the new global compressed deduplication feature enabled -Ededupe, I found some short-lived temporary pages weren't properly...

CVE-2023-52526

In the Linux kernel, the following vulnerability has been resolved: erofs: fix memory leak of LZMA global compressed deduplication When stressing microLZMA EROFS images with the new global compressed deduplication feature enabled -Ededupe, I found some short-lived temporary pages weren't properly...

CVE-2023-52526 erofs: fix memory leak of LZMA global compressed deduplication

In the Linux kernel, the following vulnerability has been resolved: erofs: fix memory leak of LZMA global compressed deduplication When stressing microLZMA EROFS images with the new global compressed deduplication feature enabled -Ededupe, I found some short-lived temporary pages weren't properly...

CVE-2023-52526 erofs: fix memory leak of LZMA global compressed deduplication

In the Linux kernel, the following vulnerability has been resolved: erofs: fix memory leak of LZMA global compressed deduplication When stressing microLZMA EROFS images with the new global compressed deduplication feature enabled -Ededupe, I found some short-lived temporary pages weren't properly...

CVE-2023-52526

The CVE-2023-52526 issue affects the Linux kernel’s erofs memory handling during global compressed deduplication. The vulnerability is a memory leak related to LZMA global deduplication under stress (enabled with -Ededupe) that could cause transient pages not to be released, potentially leading t...

SUSE CVE-2020-36775

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential deadlock Using f2fstrylockop in f2fswritecompressedpages to avoid potential deadlock like we did in f2fswritesingledatapage...