Vulnerability Details : CVE-2024-28180
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.
Products affected by CVE-2024-28180
Please log in to view affected product information.
Exploit prediction scoring system (EPSS) score for CVE-2024-28180
0.25%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 48 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2024-28180
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
2.8
|
1.4
|
GitHub, Inc. | 2024-03-09 |
CWE ids for CVE-2024-28180
-
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.Assigned by: security-advisories@github.com (Secondary)
References for CVE-2024-28180
-
https://github.com/go-jose/go-jose/commit/add6a284ea0f844fd6628cba637be5451fe4b28a
v3: backport decompression limit fix (#107) · go-jose/go-jose@add6a28 · GitHub
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJO2U5ACZVACNQXJ5EBRFLFW6DP5BROY/
[SECURITY] Fedora 39 Update: podman-tui-1.0.0-1.fc39 - package-announce - Fedora Mailing-Lists
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJDO5VSIAOGT2WP63AXAAWNRSVJCNCRH/
[SECURITY] Fedora 39 Update: apptainer-1.3.0-1.fc39 - package-announce - Fedora Mailing-Lists
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MSOMHDKRPU3A2JEMRODT2IREDFBLVPGS/
[SECURITY] Fedora 38 Update: prometheus-podman-exporter-1.11.0-1.fc38 - package-announce - Fedora Mailing-Lists
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JNPMXL36YGS3GQEVI3Q5HKHJ7YAAQXL5/
[SECURITY] Fedora 39 Update: prometheus-podman-exporter-1.11.0-1.fc39 - package-announce - Fedora Mailing-Lists
-
https://github.com/go-jose/go-jose/commit/f4c051a0653d78199a053892f7619ebf96339502
jwe: limit maximum output from decompressing (#106) · go-jose/go-jose@f4c051a · GitHub
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UG5FSEYJ3GP27FZXC5YAAMMEC5XWKJHG/
[SECURITY] Fedora 38 Update: podman-tui-1.0.0-1.fc38 - package-announce - Fedora Mailing-Lists
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG/
[SECURITY] Fedora 40 Update: podman-tui-1.0.0-1.fc40 - package-announce - Fedora Mailing-Lists
-
https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g
Improper Handling of Highly Compressed Data (Data Amplification) in github.com/go-jose/go-jose/v4 · Advisory · go-jose/go-jose · GitHub
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KXKGNCRU7OTM5AHC7YIYBNOWI742PRMY/
[SECURITY] Fedora 40 Update: apptainer-1.3.0-1.fc40 - package-announce - Fedora Mailing-Lists
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IJ6LAJJ2FTA2JVVOACCV5RZTOIZLXUNJ/
[SECURITY] Fedora 40 Update: prometheus-podman-exporter-1.11.0-1.fc40 - package-announce - Fedora Mailing-Lists
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GD2GSBQTBLYADASUBHHZV2CZPTSLIPQJ/
[SECURITY] Fedora 39 Update: singularity-ce-3.11.5^20240603gbd4675f-1.fc39 - package-announce - Fedora Mailing-Lists
-
https://github.com/go-jose/go-jose/commit/0dd4dd541c665fb292d664f77604ba694726f298
v2: backport decompression limit fix (#109) · go-jose/go-jose@0dd4dd5 · GitHub
Jump to