jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-5294 advisory.

    - Backport fix for CVE-2024-28176       Resolves: RHEL-28719

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5294 advisory.

    Jose is a C-language implementation of the Javascript Object Signing and Encryption standards. The jose     package is a dependency of the clevis and tang packages, together providing Network Bound Disk Encryption     (NBDE) in Red Hat Enterprise Linux.

    Security Fix(es):

    * jose: resource exhaustion (CVE-2024-28176)

    * jose: Denial of service due to uncontrolled CPU consumption (CVE-2023-50967)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:3968 advisory.

    * podman: jose-go: improper handling of highly compressed data (CVE-2024-28180)

    * buildah: jose-go: improper handling of highly compressed data (CVE-2024-28180)

    * podman: jose-go: resource exhaustion (CVE-2024-28176)

    * buildah: jose-go: resource exhaustion (CVE-2024-28176)

    * skopeo: jose-go: resource exhaustion (CVE-2024-28176)

    Additional Changes:

    For detailed information on changes in this release, see the Rocky Linux 8 Release Notes linked from the     References section.

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0045 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 4.16.0. See the following advisory for the container images for     this release:

    https://access.redhat.com/errata/RHSA-2024:0041

    Security Fix(es):

    * dnspython: denial of service in stub resolver (CVE-2023-29483)
    * golang: net/http/cookiejar: incorrect forwarding of sensitive headers and     cookies on HTTP redirect (CVE-2023-45289)
    * golang: net/http: memory exhaustion in Request.ParseMultipartForm     (CVE-2023-45290)
    * containers/image: digest type does not guarantee valid type     (CVE-2024-3727)
    * golang: crypto/x509: Verify panics on certificates with an unknown public     key algorithm (CVE-2024-24783)
    * golang: net/mail: comments in display names are incorrectly handled     (CVE-2024-24784)
    * golang: html/template: errors returned from MarshalJSON methods may break     template escaping (CVE-2024-24785)
    * golang-protobuf: encoding/protojson, internal/encoding/json: infinite     loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON     (CVE-2024-24786)
    * jose: resource exhaustion (CVE-2024-28176)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    All OpenShift Container Platform 4.16 users are advised to upgrade to these     updated packages and images when they are available in the appropriate     release channel. To check for available updates, use the OpenShift CLI (oc)     or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:3968 advisory.

    * podman: jose-go: improper handling of highly compressed data (CVE-2024-28180)
    * buildah: jose-go: improper handling of highly compressed data (CVE-2024-28180)
    * podman: jose-go: resource exhaustion (CVE-2024-28176)
    * buildah: jose-go: resource exhaustion (CVE-2024-28176)
    * skopeo: jose-go: resource exhaustion (CVE-2024-28176)

    Additional Changes:

    For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the     References section.

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3968 advisory.

    aardvark-dns     [2:1.10.0-1]
    - update to https://github.com/containers/aardvark-dns/releases/tag/v1.10.0
    - Related: Jira:RHEL-2110

    [2:1.9.0-1]
    - update to https://github.com/containers/aardvark-dns/releases/tag/v1.9.0
    - Related: Jira:RHEL-2110

    [2:1.8.0-1]
    - update to https://github.com/containers/aardvark-dns/releases/tag/v1.8.0
    - Related: Jira:RHEL-2110

    buildah     [2:1.33.7-2]
    - update to the latest content of https://github.com/containers/buildah/tree/release-1.33       (https://github.com/containers/buildah/commit/997beea)
    - Resolves: RHEL-28725

    cockpit-podman     [84.1-1]
    - update to https://github.com/cockpit-project/cockpit-podman/releases/tag/84.1
    - Related: Jira:RHEL-25557

    [84-1]
    - update to https://github.com/cockpit-project/cockpit-podman/releases/tag/84
    - Related: Jira:RHEL-2110

    [83-1]
    - update to https://github.com/cockpit-project/cockpit-podman/releases/tag/83
    - Related: Jira:RHEL-2110

    [82-1]
    - update to https://github.com/cockpit-project/cockpit-podman/releases/tag/82
    - Related: Jira:RHEL-2110

    [81-1]
    - update to https://github.com/cockpit-project/cockpit-podman/releases/tag/81
    - Related: Jira:RHEL-2110

    [80-1]
    - update to https://github.com/cockpit-project/cockpit-podman/releases/tag/80
    - Related: Jira:RHEL-2110

    [79-1]
    - update to https://github.com/cockpit-project/cockpit-podman/releases/tag/79
    - Related: Jira:RHEL-2110

    [78-1]
    - update to https://github.com/cockpit-project/cockpit-podman/releases/tag/78
    - Related: Jira:RHEL-2110

    [77-1]
    - update to https://github.com/cockpit-project/cockpit-podman/releases/tag/77
    - Related: Jira:RHEL-2110

    [75-1]
    - update to https://github.com/cockpit-project/cockpit-podman/releases/tag/75
    - Related: #2176055

    conmon     [3:2.1.10-1]
    - update to https://github.com/containers/conmon/releases/tag/v2.1.10
    - Related: Jira:RHEL-2110

    [3:2.1.8-1]
    - update to https://github.com/containers/conmon/releases/tag/v2.1.8
    - Related: #2176055

    containernetworking-plugins     [1:1.4.0-2]
    - rebuild
    - Resolves: RHEL-18390

    [1:1.4.0-1]
    - update to https://github.com/containernetworking/plugins/releases/tag/v1.4.0
    - Related: Jira:RHEL-2110

    containers-common     [2:1-81.0.1]
    - Updated removed references [Orabug: 33473101] (Alex Burmashev)
    - Adjust registries.conf (Nikita Gerasimov)
    - remove references to RedHat registry (Nikita Gerasimov)

    [2:1-81]
    - Update shortnames from Pyxis
    - Related: Jira:RHEL-2110

    [2:1-80]
    - bump release to preserve upgrade path
    - Resolves: Jira:RHEL-12277

    container-selinux     [2:2.229.0-2]
    - remove watch statements properly for RHEL8 and lower
    - Related: Jira:RHEL-2110

    [2:2.229.0-1]
    - update to https://github.com/containers/container-selinux/releases/tag/v2.229.0
    - Related: Jira:RHEL-2110

    [2:2.228.1-1]
    - update to https://github.com/containers/container-selinux/releases/tag/v2.228.1
    - Related: Jira:RHEL-2110

    [2:2.228.0-1]
    - update to https://github.com/containers/container-selinux/releases/tag/v2.228.0
    - Related: Jira:RHEL-2110

    [2:2.227.0-1]
    - update to https://github.com/containers/container-selinux/releases/tag/v2.227.0
    - Related: Jira:RHEL-2110

    [2:2.226.0-1]
    - update to https://github.com/containers/container-selinux/releases/tag/v2.226.0
    - remove dependency on policycoreutils-python-utils as it pulls in python
    - Related: Jira:RHEL-2110

    [2:2.224.0-1]
    - update to https://github.com/containers/container-selinux/releases/tag/v2.224.0
    - Related: Jira:RHEL-2110

    [2:2.222.0-1]
    - update to https://github.com/containers/container-selinux/releases/tag/v2.222.0
    - Related: Jira:RHEL-2110

    criu     [3.18-5]
    - rebuild to preserve upgrade path
    - Related: RHEL-32671

    [3.18-4]
    - switch to egg-info on 8.9
    - Related: #2176055

    [3.18-3]
    - remove --progress-bar option
    - Related: #2176055

    [3.18-2]
    - update to 3.18
    - Related: #2176055

    [3.17-1]
    - update to 3.17
    - Resolves: #2175794

    crun     [1.14.3-2]
    - remove BR libgcrypt-devel, no longer needed
    - Related: Jira:RHEL-2110

    [1.14.3-1]
    - update to https://github.com/containers/crun/releases/tag/1.14.3
    - Related: Jira:RHEL-2110

    [1.14.1-1]
    - update to https://github.com/containers/crun/releases/tag/1.14.1
    - Related: Jira:RHEL-2110

    [1.14-1]
    - update to https://github.com/containers/crun/releases/tag/1.14
    - Related: Jira:RHEL-2110

    [1.13-1]
    - update to https://github.com/containers/crun/releases/tag/1.13
    - Related: Jira:RHEL-2110

    [1.12-1]
    - update to https://github.com/containers/crun/releases/tag/1.12
    - Related: Jira:RHEL-2110

    [1.11.2-1]
    - update to https://github.com/containers/crun/releases/tag/1.11.2
    - Related: Jira:RHEL-2110

    [1.11.1-1]
    - update to https://github.com/containers/crun/releases/tag/1.11.1
    - Related: Jira:RHEL-2110

    [1.11-1]
    - update to https://github.com/containers/crun/releases/tag/1.11
    - Related: Jira:RHEL-2110

    [1.9.2-1]
    - update to https://github.com/containers/crun/releases/tag/1.9.2
    - Related: Jira:RHEL-2110

    [1.9.1-1]
    - update to https://github.com/containers/crun/releases/tag/1.9.1
    - Related: Jira:RHEL-2110

    [1.9-1]
    - update to https://github.com/containers/crun/releases/tag/1.9
    - Related: Jira:RHEL-2110

    fuse-overlayfs     [1.13-1]
    - update to https://github.com/containers/fuse-overlayfs/releases/tag/v1.13
    - Related: Jira:RHEL-2110

    libslirp     [4.4.0-2]
    - rebuild to preserve upgrade path 8.9 -> 8.10
    - Related: RHEL-32671

    netavark     [2:1.10.3-1]
    - update to https://github.com/containers/netavark/releases/tag/v1.10.3
    - Related: Jira:RHEL-2110

    [2:1.10.2-1]
    - update to https://github.com/containers/netavark/releases/tag/v1.10.2
    - Related: Jira:RHEL-2110

    [2:1.10.1-1]
    - update to https://github.com/containers/netavark/releases/tag/v1.10.1
    - Related: Jira:RHEL-2110

    [2:1.10.0-1]
    - update to https://github.com/containers/netavark/releases/tag/v1.10.0
    - Related: Jira:RHEL-2110

    [2:1.9.0-1]
    - update to https://github.com/containers/netavark/releases/tag/v1.9.0
    - Related: Jira:RHEL-2110

    [2:1.8.0-2]
    - fix directory for systemd units
    - Related: Jira:RHEL-2110

    [2:1.8.0-1]
    - update to https://github.com/containers/netavark/releases/tag/v1.8.0
    - Related: Jira:RHEL-2110

    oci-seccomp-bpf-hook     [1.2.10-1]
    - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.10
    - Related: Jira:RHEL-2110

    podman     [4:4.9.4-3.0.1]
    - Add devices on container startup, not on creation

    [4:4.9.4-3]
    - BR: /usr/bin/man
    - Related: RHEL-28727

    [4:4.9.4-2]
    - update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel       (https://github.com/containers/podman/commit/6464b2c)
    - Resolves: RHEL-28727

    python-podman     [4.9.0-1]
    - update to https://github.com/containers/podman-py/releases/tag/v4.9.0
    - Related: Jira:RHEL-2110

    [4.8.2-1]
    - update to https://github.com/containers/podman-py/releases/tag/v4.8.2
    - Related: Jira:RHEL-2110

    [4.8.0.post1-1]
    - update to https://github.com/containers/podman-py/releases/tag/v4.8.0.post1
    - Related: Jira:RHEL-2110

    [4.7.0-1]
    - update to https://github.com/containers/podman-py/releases/tag/v4.7.0
    - Related: Jira:RHEL-2110

    runc     skopeo     [2:1.14.3-2]
    - update to the latest content of https://github.com/containers/skopeo/tree/release-1.14       (https://github.com/containers/skopeo/commit/5f2b9af)
    - Resolves: RHEL-28728

    [2:1.14.3-1]
    - update to the latest content of https://github.com/containers/skopeo/tree/release-1.14       (https://github.com/containers/skopeo/commit/4a2bc3a)
    - Resolves: RHEL-28226

    slirp4netns     [1.2.3-1]
    - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.3
    - Related: Jira:RHEL-2110

    [1.2.2-1]
    - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.2
    - Related: Jira:RHEL-2110

    udica     [0.2.6-21]
    - bump release to preserve update path
    - Resolves: RHEL-32671

    [0.2.6-20]
    - bump release to preserve update path
    - Related: #2139052

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3968 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * podman: jose-go: improper handling of highly compressed data (CVE-2024-28180)

    * buildah: jose-go: improper handling of highly compressed data (CVE-2024-28180)

    * podman: jose-go: resource exhaustion (CVE-2024-28176)

    * buildah: jose-go: resource exhaustion (CVE-2024-28176)

    * skopeo: jose-go: resource exhaustion (CVE-2024-28176)

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:3826 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fixes:

    * podman: jose-go: improper handling of highly compressed data (CVE-2024-28180)

    * podman: golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)

    * podman: jose: resource exhaustion (CVE-2024-28176)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:3827 advisory.

    * golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)

    * jose-go: improper handling of highly compressed data (CVE-2024-28180)

    * buildah: jose: resource exhaustion (CVE-2024-28176)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:3826 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fixes:

    * podman: jose-go: improper handling of highly compressed data (CVE-2024-28180)
    * podman: golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
    * podman: jose: resource exhaustion (CVE-2024-28176)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:3827 advisory.

    * golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
    * jose-go: improper handling of highly compressed data (CVE-2024-28180)
    * buildah: jose: resource exhaustion (CVE-2024-28176)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3827 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Security Fix(es):

    * golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)

    * jose-go: improper handling of highly compressed data (CVE-2024-28180)

    * buildah: jose: resource exhaustion (CVE-2024-28176)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3826 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fixes:

    * podman: jose-go: improper handling of highly compressed data (CVE-2024-28180)

    * podman: golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)

    * podman: jose: resource exhaustion (CVE-2024-28176)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3827 advisory.

    [1.33.7-2.0.1]
    - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178]

    [2:1.33.7-2]
    - update to the latest content of https://github.com/containers/buildah/tree/release-1.33       (https://github.com/containers/buildah/commit/997beea)
    - Resolves: RHEL-28731

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3826 advisory.

    [4.9.4-4.0.1]
    - Improved saving remote build context to tarfile in Podman daemon [Orabug: 36495655]
    - Add devices on container startup, not on creation
    - Backport fast gzip for compression [Orabug: 36420418]
    - overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694]
    - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404]

    [4:4.9.4-4]
    - update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel       (https://github.com/containers/podman/commit/4afc71a)
    - Resolves: RHEL-28735

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-831bad8f8f advisory.

  - jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens     (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS),     and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces,     specifically related to the support for decompressing plaintext after its decryption. Under certain     conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory     during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.
    (CVE-2024-28176)

  - Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of     standards. An attacker could send a JWE containing compressed data that used large amounts of memory and     CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed     data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been     patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-560a7aca85 advisory.

  - jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens     (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS),     and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces,     specifically related to the support for decompressing plaintext after its decryption. Under certain     conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory     during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.
    (CVE-2024-28176)

  - Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of     standards. An attacker could send a JWE containing compressed data that used large amounts of memory and     CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed     data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been     patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-22f1e313dd advisory.

  - jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens     (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS),     and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces,     specifically related to the support for decompressing plaintext after its decryption. Under certain     conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory     during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.
    (CVE-2024-28176)

  - Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of     standards. An attacker could send a JWE containing compressed data that used large amounts of memory and     CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed     data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been     patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-529fe8a802 advisory.

  - jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens     (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS),     and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces,     specifically related to the support for decompressing plaintext after its decryption. Under certain     conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory     during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.
    (CVE-2024-28176)

  - Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of     standards. An attacker could send a JWE containing compressed data that used large amounts of memory and     CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed     data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been     patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-453ee0b3b9 advisory.

  - jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens     (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS),     and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces,     specifically related to the support for decompressing plaintext after its decryption. Under certain     conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory     during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.
    (CVE-2024-28176)

  - Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of     standards. An attacker could send a JWE containing compressed data that used large amounts of memory and     CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed     data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been     patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
205534	Oracle Linux 8 : jose (ELSA-2024-5294)	Nessus	Oracle Linux Local Security Checks	medium
205511	RHEL 8 : jose (RHSA-2024:5294)	Nessus	Red Hat Local Security Checks	medium
201249	Rocky Linux 8 : container-tools:rhel8 bug fix and enhancement update (Moderate) (RLSA-2024:3968)	Nessus	Rocky Linux Local Security Checks	medium
201091	RHEL 9 : OpenShift Container Platform 4.16.0 (RHSA-2024:0045)	Nessus	Red Hat Local Security Checks	high
200733	AlmaLinux 8 : container-tools:rhel8 bug fix and enhancement update (Medium) (ALSA-2024:3968)	Nessus	Alma Linux Local Security Checks	medium
200721	Oracle Linux 8 : container-tools:ol8 (ELSA-2024-3968)	Nessus	Oracle Linux Local Security Checks	medium
200677	RHEL 8 : container-tools:rhel8 update (Moderate) (RHSA-2024:3968)	Nessus	Red Hat Local Security Checks	medium
200574	Rocky Linux 9 : podman (RLSA-2024:3826)	Nessus	Rocky Linux Local Security Checks	medium
200563	Rocky Linux 9 : buildah (RLSA-2024:3827)	Nessus	Rocky Linux Local Security Checks	medium
200546	AlmaLinux 9 : podman (ALSA-2024:3826)	Nessus	Alma Linux Local Security Checks	medium
200544	AlmaLinux 9 : buildah (ALSA-2024:3827)	Nessus	Alma Linux Local Security Checks	medium
200429	RHEL 9 : buildah (RHSA-2024:3827)	Nessus	Red Hat Local Security Checks	medium
200415	RHEL 9 : podman (RHSA-2024:3826)	Nessus	Red Hat Local Security Checks	medium
200390	Oracle Linux 9 : buildah (ELSA-2024-3827)	Nessus	Oracle Linux Local Security Checks	medium
200389	Oracle Linux 9 : podman (ELSA-2024-3826)	Nessus	Oracle Linux Local Security Checks	medium
194609	Fedora 40 : podman-tui (2024-831bad8f8f)	Nessus	Fedora Local Security Checks	medium
194565	Fedora 40 : apptainer (2024-560a7aca85)	Nessus	Fedora Local Security Checks	medium
192716	Fedora 39 : podman-tui (2024-22f1e313dd)	Nessus	Fedora Local Security Checks	medium
192715	Fedora 38 : podman-tui (2024-529fe8a802)	Nessus	Fedora Local Security Checks	medium
192459	Fedora 39 : apptainer (2024-453ee0b3b9)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2024-28176

medium

Tenable Plugins

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium