CVE-2024-28180

Description

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

References

https://lists.fedoraproject.org/archives/list/[email protected]/message/XJDO5VSIAOGT2WP63AXAAWNRSVJCNCRH/

https://lists.fedoraproject.org/archives/list/[email protected]/message/UJO2U5ACZVACNQXJ5EBRFLFW6DP5BROY/

https://lists.fedoraproject.org/archives/list/[email protected]/message/UG5FSEYJ3GP27FZXC5YAAMMEC5XWKJHG/

https://lists.fedoraproject.org/archives/list/[email protected]/message/MSOMHDKRPU3A2JEMRODT2IREDFBLVPGS/

https://lists.fedoraproject.org/archives/list/[email protected]/message/KXKGNCRU7OTM5AHC7YIYBNOWI742PRMY/

https://lists.fedoraproject.org/archives/list/[email protected]/message/JNPMXL36YGS3GQEVI3Q5HKHJ7YAAQXL5/

https://lists.fedoraproject.org/archives/list/[email protected]/message/IJ6LAJJ2FTA2JVVOACCV5RZTOIZLXUNJ/

https://lists.fedoraproject.org/archives/list/[email protected]/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG/

https://lists.fedoraproject.org/archives/list/[email protected]/message/GD2GSBQTBLYADASUBHHZV2CZPTSLIPQJ/

https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g

https://github.com/go-jose/go-jose/commit/f4c051a0653d78199a053892f7619ebf96339502

https://github.com/go-jose/go-jose/commit/add6a284ea0f844fd6628cba637be5451fe4b28a

https://github.com/go-jose/go-jose/commit/0dd4dd541c665fb292d664f77604ba694726f298

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3