[Bug 1235208] New: VUL-0: CVE-2024-28180: cri-o: gopkg.in/square/go-jose.v2: improper handling of highly compressed data
https://bugzilla.suse.com/show_bug.cgi?id=1235208 Bug ID: 1235208 Summary: VUL-0: CVE-2024-28180: cri-o: gopkg.in/square/go-jose.v2: improper handling of highly compressed data Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/396762/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: jkowalczyk@suse.com Reporter: andrea.mattiazzo@suse.com QA Contact: security-team@suse.de Blocks: 1234984 Target Milestone: --- Found By: --- Blocker: --- Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-28180 https://www.cve.org/CVERecord?id=CVE-2024-28180 https://github.com/go-jose/go-jose/commit/0dd4dd541c665fb292d664f77604ba6947... https://github.com/go-jose/go-jose/commit/add6a284ea0f844fd6628cba637be5451f... https://github.com/go-jose/go-jose/commit/f4c051a0653d78199a053892f7619ebf96... https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g https://bugzilla.redhat.com/show_bug.cgi?id=2268854 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/28xxx/CVE-2024-... -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1235208 https://bugzilla.suse.com/show_bug.cgi?id=1235208#c1 --- Comment #1 from Andrea Mattiazzo <andrea.mattiazzo@suse.com> --- The packages below are or contain embedded packages that are vulnerable to CVE-2024-28180: - openSUSE:Factory/cri-o contains embedded package: gopkg.in/square/go-jose.v2 (2.5.1) Please consider version bumping or patching the affected dependencies. The listed codestreams are affected. All other codestreams should not be affected, but feel free to double-check. This is a auto-generated message, please reach out to the reporter directly if you think this is incorrect. No bug-owner found for these packages, if the assignation is not correct feel free to re-assign. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1235208 SMASH SMASH <smash_bz@suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠suse.com