[SECURITY] Fedora 38 Update: jose-13-1.fc38

Jos=EF=BF=BD=EF=BF=BD is a command line utility for performing various tasks on JSON Object Signing and Encryption JOSE objects. Jos=EF=BF=BD=EF=BF=BD provides a full crypto stack including key generation, signing and encryption...

[SECURITY] Fedora 39 Update: jose-13-1.fc39

Jos=EF=BF=BD=EF=BF=BD is a command line utility for performing various tasks on JSON Object Signing and Encryption JOSE objects. Jos=EF=BF=BD=EF=BF=BD provides a full crypto stack including key generation, signing and encryption...

Fedora 39 : jose (2024-a94b67a7b2)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-a94b67a7b2 advisory. Security fix for CVE-2023-50967 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

Fedora 38 : jose (2024-f98bdff610)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-f98bdff610 advisory. Security fix for CVE-2023-50967 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service and remote attack due to node.js jose module and jsonata-js JSONata (CVE-2024-28176, CVE-2024-27307)

Summary The Discovery Connector nodes in IBM App Connect Enterprise are vulnerable to a denial of service due to node.js jose module and jsonata-js JSONata. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2024-28176 DESCRIPTION: Node.js jos...

FreeBSD : jose -- DoS vulnerability (02be46c1-f7cc-11ee-aa6b-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 02be46c1-f7cc-11ee-aa6b-b42e991fc52e advisory. - latchset jose through version 11 allows attackers to cause a denial of service CPU consumption via a...

CVE-2024-28180

...

The vulnerability of the module for signing and encrypting JSON objects in Erlang and Elixir programming languages, namely erlang-jose (JOSE for Erlang), involves an uncontrolled resource consumption. This allows a malicious actor to trigger a service failure.

The vulnerability of the module for signing and encrypting JSON objects in Erlang and Elixir programming languages, namely erlang-jose JOSE for Erlang, is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures remotel...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.19 security update

Red Hat OpenShift Container Platform release 4.14.19 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

jose-go: improper handling of highly compressed data

A vulnerability was found in Jose due to improper handling of highly compressed data. This issue could allow an attacker to send a JWE containing compressed data that uses large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti...

jose-go: improper handling of highly compressed data

A vulnerability was found in Jose due to improper handling of highly compressed data. This issue could allow an attacker to send a JWE containing compressed data that uses large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti...

RHEL 8 / 9 : OpenShift Container Platform 4.12.54 (RHSA-2024:1574)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1574 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...

RHCOS 4 : OpenShift Container Platform 4.12.54 (RHSA-2024:1574)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1574 advisory. - golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads CVE-2024-1394 - golang-protobuf:...

RHEL 8 / 9 : OpenShift Container Platform 4.14.19 (RHSA-2024:1567)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1567 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...

jose-go: improper handling of highly compressed data

A vulnerability was found in Jose due to improper handling of highly compressed data. This issue could allow an attacker to send a JWE containing compressed data that uses large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.15.6 packages and security update

Red Hat OpenShift Container Platform release 4.15.6 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.15. Red Hat Product Security has rated this update as having a...

RHCOS 4 : OpenShift Container Platform 4.15.6 (RHSA-2024:1563)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1563 advisory. - golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads CVE-2024-1394 - golang-protobuf:...

Fedora 38 : podman-tui (2024-529fe8a802)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-529fe8a802 advisory. podman-tui release v1.0.0 ---- Security fix for CVE-2024-28180 Tenable has extracted the preceding description block directly from the Fedora securi...

Fedora 39 : prometheus-podman-exporter (2024-a8a4ce2864)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-a8a4ce2864 advisory. release v1.11.0 ---- release v1.10.1 ---- release v1.10.0 Tenable has extracted the preceding description block directly from the Fedora security advisory...

Fedora 38 : prometheus-podman-exporter (2024-45f0a1df95)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-45f0a1df95 advisory. release v1.11.0 ---- release v1.10.1 ---- release v1.10.0 Tenable has extracted the preceding description block directly from the Fedora security advisory...