CVE-2024-28180

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-28180
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-28180.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-28180
Aliases
Related
Published
2024-03-09T01:15:07Z
Modified
2024-10-15T05:57:01.017463Z
Summary
[none]
Details

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

References

Affected packages

Debian:13 / golang-github-go-jose-go-jose

Package

Name
golang-github-go-jose-go-jose
Purl
pkg:deb/debian/golang-github-go-jose-go-jose?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.0.1-1

Affected versions

3.*

3.0.1-1
3.0.1-2~bpo12+1
3.0.1-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:11 / golang-gopkg-square-go-jose.v2

Package

Name
golang-gopkg-square-go-jose.v2
Purl
pkg:deb/debian/golang-gopkg-square-go-jose.v2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.5.1-2
2.6.0-1
2.6.0-2
2.6.3-1
2.6.3-2
2.6.3-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / golang-gopkg-square-go-jose.v2

Package

Name
golang-gopkg-square-go-jose.v2
Purl
pkg:deb/debian/golang-gopkg-square-go-jose.v2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.6.0-2
2.6.3-1
2.6.3-2
2.6.3-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / golang-gopkg-square-go-jose.v2

Package

Name
golang-gopkg-square-go-jose.v2
Purl
pkg:deb/debian/golang-gopkg-square-go-jose.v2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.6.3-1

Affected versions

2.*

2.6.0-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/go-jose/go-jose

Affected ranges

Type
GIT
Repo
https://github.com/go-jose/go-jose
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
Fixed
Fixed

Affected versions

v2.*

v2.0.0
v2.0.1
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.2
v2.3.0
v2.3.1
v2.4.0
v2.4.1
v2.5.0
v2.5.1
v2.6.0
v2.6.1
v2.6.2

v3.*

v3.0.0
v3.0.0-rc.1
v3.0.2

v4.*

v4.0.0