https://bugzilla.suse.com/show_bug.cgi?id=1235212 https://bugzilla.suse.com/show_bug.cgi?id=1235212#c1 Bug ID: 1235212 Summary: VUL-0: CVE-2024-28180: kubearmor-client: github.com/go-jose/go-jose/v3: improper handling of highly compressed data Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/396762/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: opensuse_buildservice@ojkastl.de Reporter: andrea.mattiazzo@suse.com QA Contact: security-team@suse.de Blocks: 1234984 Target Milestone: --- Found By: --- Blocker: --- --- Comment #1 from Andrea Mattiazzo <andrea.mattiazzo@suse.com> --- Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-28180 https://www.cve.org/CVERecord?id=CVE-2024-28180 https://github.com/go-jose/go-jose/commit/0dd4dd541c665fb292d664f77604ba6947... https://github.com/go-jose/go-jose/commit/add6a284ea0f844fd6628cba637be5451f... https://github.com/go-jose/go-jose/commit/f4c051a0653d78199a053892f7619ebf96... https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g https://bugzilla.redhat.com/show_bug.cgi?id=2268854 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://lists.fedoraproject.org/archives/list/package-announce@lists.fedorap... https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/28xxx/CVE-2024-... -- You are receiving this mail because: You are on the CC list for the bug.