UBUNTU-CVE-2024-28180

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2024-28180
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-28180.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2024-28180
Related
Published
2024-03-09T01:15:00Z
Modified
2024-10-15T14:14:09Z
Summary
[none]
Details

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

References

Affected packages

Ubuntu:24.10 / golang-github-go-jose-go-jose

Package

Name
golang-github-go-jose-go-jose
Purl
pkg:deb/ubuntu/golang-github-go-jose-go-jose?arch=src?distro=oracular

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.0.1-4
4.0.2-1
4.0.3-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / golang-github-go-jose-go-jose

Package

Name
golang-github-go-jose-go-jose
Purl
pkg:deb/ubuntu/golang-github-go-jose-go-jose?arch=src?distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.0.1-1
3.0.1-2

4.*

4.0.1-4
4.0.1-4ubuntu0.1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}