Denial Of Service (DoS)

🗓️ 08 Mar 2024 07:28:34Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 29 Views

Jose vulnerability to DoS due to flaw in plaintext post-decryption support with high compression ratio exploit

Reporter	Title	Published	Views	Family All 141
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in Node.js jose module	26 Feb 202518:43	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak for Multicloud Management	20 Mar 202517:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Concert Software is vulnerable to multiple issues	15 Apr 202503:14	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	14 Aug 202409:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service and remote attack due to node.js jose module and jsonata-js JSONata (CVE-2024-28176, CVE-2024-27307)	16 Apr 202415:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar EDR Software contains multiple vulnerabilities	9 Jul 202417:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is vulnerable to a denial of service attack (CVE-2024-28176).	25 Apr 202405:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses jose-2.0.6.tgz which is vulnerable to CVE-2024-28176.	17 Jun 202408:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite: jose-4.15.4.tgz is vulnerable to CVE-2024-28176 used in IBM Maximo Application Suite - Edge Data Collector	29 Jul 202412:58	–	ibm
Tenable Nessus	Alibaba Cloud Linux 3 : 0145: container-tools:rhel8 bug fix and enhancement update (Moderate) (ALINUX3-SA-2024:0145)	14 May 202500:00	–	nessus

Vulners

Node

jose_project joseRange3.0.0–4.15.4js

jose_project joseRange0.1.0–2.0.6js

jose-node-cjs-runtime_project jose-node-cjs-runtimeRange3.7.1–4.15.4js

jose-node-esm-runtime jose-node-esm-runtimeRange3.8.0–4.15.4js

Source	Link
github	www.github.com/panva/jose/commit/1b91d88d2f8233f3477a5f4579aa5f8057b2ee8b
github	www.github.com/panva/jose/commit/02a65794f7873cdaf12e81e80ad076fcdc4a9314
github	www.github.com/panva/jose/security/advisories/GHSA-hhhv-q57g-882q
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/KXKGNCRU7OTM5AHC7YIYBNOWI742PRMY/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/UG5FSEYJ3GP27FZXC5YAAMMEC5XWKJHG/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/UJO2U5ACZVACNQXJ5EBRFLFW6DP5BROY/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/XJDO5VSIAOGT2WP63AXAAWNRSVJCNCRH/

30 Mar 2024 06:59Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.14.9

EPSS0.00572

SSVC