CVE-2024-28180

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-28180
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28180.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-28180
Aliases
Downstream
Related
Published
2024-03-09T00:54:46.382Z
Modified
2026-02-23T08:37:39.612175Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)
Details

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28180.json",
    "cwe_ids": [
        "CWE-409"
    ]
}
References

Affected packages

Git / github.com/go-jose/go-jose

Affected ranges

Type
GIT
Repo
https://github.com/go-jose/go-jose
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0dd4dd541c665fb292d664f77604ba694726f298
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
add6a284ea0f844fd6628cba637be5451fe4b28a
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f4c051a0653d78199a053892f7619ebf96339502

Affected versions

v2.*
v2.0.0
v2.0.1
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.2
v2.3.0
v2.3.1
v2.4.0
v2.4.1
v2.5.0
v2.5.1
v2.6.0
v2.6.1
v2.6.2
v3.*
v3.0.0
v3.0.0-rc.1
v3.0.2
v4.*
v4.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28180.json"

Git / gitlab.com/gnutls/gnutls

Affected ranges

Type
GIT
Repo
https://gitlab.com/gnutls/gnutls
Events
Introduced
3b0b75ab6d15cba8758248f451be0c86c28a3e22
Fixed
d74073847cbee94d70971ab8f1660f7cf268fc3c
Introduced
6323bbcda7e1b075a2defdf34e04008764da1a8c
Fixed
07b8e61914898c2494aff75bf35a716c2069f80f

Affected versions

Other
gnutls_2_0_0
gnutls_2_0_1
gnutls_2_1_0
gnutls_2_1_1
gnutls_2_1_2
gnutls_2_1_3
gnutls_2_1_4
gnutls_2_1_5
gnutls_2_1_6
gnutls_2_1_7
gnutls_2_1_8
gnutls_2_3_0
gnutls_2_3_1
gnutls_2_3_10
gnutls_2_3_11
gnutls_2_3_12
gnutls_2_3_13
gnutls_2_3_14
gnutls_2_3_15
gnutls_2_3_2
gnutls_2_3_3
gnutls_2_3_4
gnutls_2_3_4_netconf_0
gnutls_2_3_4_netconf_1
gnutls_2_3_4_netconf_2
gnutls_2_3_5
gnutls_2_3_6
gnutls_2_3_7
gnutls_2_3_8
gnutls_2_3_9
gnutls_2_4_0
gnutls_2_5_0
gnutls_2_5_1
gnutls_2_5_2
gnutls_2_5_3
gnutls_2_5_4
gnutls_2_5_5
gnutls_2_5_6
gnutls_2_5_7
gnutls_2_5_8
gnutls_2_5_9
gnutls_2_6_0
gnutls_2_6_1
gnutls_2_6_2
gnutls_3_0_0
gnutls_3_0_2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28180.json"