Ubuntu.comUB:CVE-2024-28180CVE-2024-28180
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
7.1 High
AI Score
Confidence
Low
0.0005 Low
EPSS
Percentile
17.1%
Package jose aims to provide an implementation of the Javascript Object
Signing and Encryption set of standards. An attacker could send a JWE
containing compressed data that used large amounts of memory and CPU when
decompressed by Decrypt or DecryptMulti. Those functions now return an
error if the decompressed data would exceed 250kB or 10x the compressed
size (whichever is larger). This vulnerability has been patched in versions
4.0.1, 3.0.3 and 2.6.3.
Bugs
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 24.04 | noarch | golang-github-go-jose-go-jose | < any | UNKNOWN |
References
github.com/go-jose/go-jose/commit/0dd4dd541c665fb292d664f77604ba694726f298
github.com/go-jose/go-jose/commit/0dd4dd541c665fb292d664f77604ba694726f298 (v2.6.3)
github.com/go-jose/go-jose/commit/add6a284ea0f844fd6628cba637be5451fe4b28a
github.com/go-jose/go-jose/commit/add6a284ea0f844fd6628cba637be5451fe4b28a (v3.0.3)
github.com/go-jose/go-jose/commit/f4c051a0653d78199a053892f7619ebf96339502
github.com/go-jose/go-jose/commit/f4c051a0653d78199a053892f7619ebf96339502 (v4.0.1)
github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g
launchpad.net/bugs/cve/CVE-2024-28180
nvd.nist.gov/vuln/detail/CVE-2024-28180
security-tracker.debian.org/tracker/CVE-2024-28180
www.cve.org/CVERecord?id=CVE-2024-28180
Related
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
7.1 High
AI Score
Confidence
Low
0.0005 Low
EPSS
Percentile
17.1%