CVE-2024-28180
CVE-2024-28180 · Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.
CVSS 4.3 · Media · EPSS 2,0% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: system
Productos y versiones afectados
go-jose
- Versiones
- < 4.0.1: Afectada
- < 3.0.3: Afectada
- < 2.6.3: Afectada
Sin corrección publicada
golang-github-go-jose-go-jose Debian:13
- Intervalos de versiones afectados
- ECOSYSTEM: < 4.0.1-1
Actualiza a 4.0.1-1
golang-github-go-jose-go-jose Debian:14
- Intervalos de versiones afectados
- ECOSYSTEM: < 4.0.1-1
Actualiza a 4.0.1-1
golang-gopkg-square-go-jose.v2 Debian:12
- Versiones
- 2.6.0-2
- 2.6.3-1
- 2.6.3-2
- 2.6.3-3
- 2.6.3-4
- 2.6.3-4~exp0
- Intervalos de versiones afectados
- ECOSYSTEM: (−∞, +∞)
Sin corrección publicada
golang-gopkg-square-go-jose.v2 Debian:13
- Intervalos de versiones afectados
- ECOSYSTEM: < 2.6.3-1
Actualiza a 2.6.3-1
golang-gopkg-square-go-jose.v2 Debian:14
- Intervalos de versiones afectados
- ECOSYSTEM: < 2.6.3-1
Actualiza a 2.6.3-1
Fuentes originales
- https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g
- https://github.com/go-jose/go-jose/commit/0dd4dd541c665fb292d664f77604ba694726f298
- https://github.com/go-jose/go-jose/commit/add6a284ea0f844fd6628cba637be5451fe4b28a
- https://github.com/go-jose/go-jose/commit/f4c051a0653d78199a053892f7619ebf96339502
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XJDO5VSIAOGT2WP63AXAAWNRSVJCNCRH/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/KXKGNCRU7OTM5AHC7YIYBNOWI742PRMY/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/UJO2U5ACZVACNQXJ5EBRFLFW6DP5BROY/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/UG5FSEYJ3GP27FZXC5YAAMMEC5XWKJHG/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/IJ6LAJJ2FTA2JVVOACCV5RZTOIZLXUNJ/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/JNPMXL36YGS3GQEVI3Q5HKHJ7YAAQXL5/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/MSOMHDKRPU3A2JEMRODT2IREDFBLVPGS/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/GD2GSBQTBLYADASUBHHZV2CZPTSLIPQJ/
- https://nvd.nist.gov/vuln/detail/CVE-2024-28180