https://bugzilla.suse.com/show_bug.cgi?id=1235208 Bug ID: 1235208 Summary: VUL-0: CVE-2024-28180: cri-o: gopkg.in/square/go-jose.v2: improper handling of highly compressed data Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/396762/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: jkowalczyk@suse.com Reporter: andrea.mattiazzo@suse.com QA Contact: security-team@suse.de Blocks: 1234984 Target Milestone: --- Found By: --- Blocker: --- Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-28180 https://www.cve.org/CVERecord?id=CVE-2024-28180 https://github.com/go-jose/go-jose/commit/0dd4dd541c665fb292d664f77604ba6947... https://github.com/go-jose/go-jose/commit/add6a284ea0f844fd6628cba637be5451f... https://github.com/go-jose/go-jose/commit/f4c051a0653d78199a053892f7619ebf96... https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g https://bugzilla.redhat.com/show_bug.cgi?id=2268854 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/28xxx/CVE-2024-... -- You are receiving this mail because: You are on the CC list for the bug.