AZL-38130 CVE-2024-28180 affecting package telegraf for versions less than 1.29.4-8

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

AZL-44373 CVE-2024-28180 affecting package buildah for versions less than 1.41.4-2

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

AZL-35877 CVE-2024-28180 affecting package containerd for versions less than 1.7.13-6

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

UBUNTU-CVE-2024-28180

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

CVE-2024-28180

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

CVE-2024-28180

The CVE-2024-28180 entry describes a memory/CPU exhaustion flaw in jose’s JWE decompress logic, where Decrypt/DecryptMulti may blow up on large decompressed data. The advisory notes patches in jose upstream (versions 4.0.1, 3.0.3, 2.6.3). Connected Mariner records show this CVE being tracked acro...

CVE-2024-28180 Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

CVE-2024-28180 Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

CVE-2024-28176 jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens JWT, JSON Web Signature JWS, JSON Web Encryption JWE, JSON Web Key JWK, JSON Web Key Set JWKS, and more. A vulnerability has been identified in the JSON Web Encryption JWE decryption interfaces...

CVE-2024-28176

Observed : CVE-2024-28176 affects the jose library (JWE) via the decryption path that decompresses plaintext, enabling potential CPU/memory exhaustion. Multiple connected advisories confirm this vulnerability across several distributions ( MiracleLinux, Alibaba Cloud Linux, TencentOS Server ) and...

jose Security Vulnerabilities

jose is a JavaScript module for signing and encrypting JSON objects. A security vulnerability exists in jose versions prior to 2.0.7 and 4.15.5 that could allow an attacker to exhaust resources via a specially crafted JWE with compressed plaintext...

jose Security Vulnerabilities

jose is a JavaScript module for signing and encrypting JSON objects. A security vulnerability exists in jose versions prior to 4.0.1, 3.0.3, and 2.6.3, which allows an attacker to send JWEs containing compressed data that uses a large amount of memory and CPU when decompressed via Decrypt or...

Data Amplification

github.com/go-jose/go-jose is vulnerable to Data Amplification. The vulnerability due to insufficient checks or controls in the handling of compressed data within the Decrypt or DecryptMulti functions. Specifically, when an attacker sends a JSON Web Encryption JWE containing compressed data, the...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification. An attacker could send a JWE containing compressed data that, when decompressed by Decrypt or DecryptMulti, would use large amounts of memory and CPU. Remediation There is ...

@decentralized-identity/ion-sdk (>=0.1.0, <=0.4.1), @tadashi/jwt (>=6.0.0, <=7.0.0) +21 more potentially affected by CVE-2024-28176 via jose (>=2.0.1, <=2.0.5)

jose NPM version =2.0.1, =0.1.0, =6.0.0, =3.0.4, =3.0.4, =3.0.5, =3.0.4, =3.0.5, =3.0.4, =3.0.6, =3.0.3, =3.0.5, =3.1.0, =2.3.2, =0.1.0, =1.2.4 and more Source cves: CVE-2024-28176 Source advisory: OSV:GHSA-HHHV-Q57G-882Q...

cortex-cli (>=2.0.8, <=2.1.1) potentially affected by CVE-2024-28176 via jose-node-cjs-runtime (>=4.6.0, <=4.10.0)

jose-node-cjs-runtime NPM version =4.6.0, =2.0.8, =2.1.1 Source cves: CVE-2024-28176 Source advisory: OSV:GHSA-HHHV-Q57G-882Q...

@adobe/helix-google-support (>=1.3.4, <=3.0.8), @adobe/helix-html-pipeline (>=3.0.0, <=5.0.11) +452 more potentially affected by CVE-2024-28176 via jose (>=3.7.0, <=4.15.4)

jose NPM version =3.7.0, =1.3.4, =3.0.0, =1.11.39, =8.0.0, =2.1.2, =1.6.0, =2.1.1, =1.5.3, =7.1.0, =0.1.0, =1.23.2, =0.1.1, =0.1.4 and more Source cves: CVE-2024-28176 Source advisory: OSV:GHSA-HHHV-Q57G-882Q...

PT-2024-2050

Name of the Vulnerable Software and Affected Versions go-jose versions prior to 2.6.3 go-jose versions prior to 3.0.3 go-jose versions prior to 4.0.1 Description The issue is related to the incorrect handling of highly compressed input data in the go-jose package, which implements the Javascript...

The vulnerability of the Jose4j JWT library, related to the incorrect implementation of the PBES2 algorithm when processing the p2c parameter, allows a violator to trigger a service failure.

The vulnerability of the Jose4j JWT library is related to the incorrect implementation of the PBES2 algorithm when processing the p2c parameter. Exploiting this vulnerability can allow an attacker who operates remotely to cause a service failure...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in go-jose [GHSA-2c7c-3mj9-8fqh](IBM X-Force ID: 273242)

Summary Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in go-jose, caused by a "billion hashes attack" when decrypting JWE inputs GHSA-2c7c-3mj9-8fqh IBM X-Force ID: 273242. Go-jose is included as a component of operators us...