CVE-2024-28180

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-28180
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28180.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-28180
Aliases
Related
Published
2024-03-09T01:15:07Z
Modified
2024-06-21T16:29:28.170007Z
Summary
[none]
Details

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

References

Affected packages

Git / github.com/go-jose/go-jose

Affected ranges

Type
GIT
Repo
https://github.com/go-jose/go-jose
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
Fixed
Fixed

Affected versions

v2.*

v2.0.0
v2.0.1
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.2
v2.3.0
v2.3.1
v2.4.0
v2.4.1
v2.5.0
v2.5.1
v2.6.0
v2.6.1
v2.6.2

v3.*

v3.0.0
v3.0.0-rc.1
v3.0.2

v4.*

v4.0.0