CVE-2024-28180
Medium
Description
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.
SeverityMedium
CVSS4.3
Exploit probability—
Product
Go-jose
PublishedMar 9, 2024
First seenMar 9, 2024
Weakness typeCWE-409CWE-409
How to fix
Update
- go-jose_project go-jose2.6.3, 3.0.3, 4.0.1 or later
- github.com/go-jose/go-jose/v44.0.1 or later
- github.com/go-jose/go-jose/v33.0.3 or later
- gopkg.in/go-jose/go-jose.v22.6.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| go-jose_project go-jose | 2.0.0 ≤ v < 2.6.3, 3.0.0 ≤ v < 3.0.3, 4.0.0 ≤ v < 4.0.1 | 2.6.3, 3.0.3, 4.0.1 |
| fedoraproject fedora | 38 ≤ v ≤ 40 | — |
| github.com/go-jose/go-jose/v4Go | v < 4.0.1 | 4.0.1 |
| github.com/go-jose/go-jose/v3Go | v < 3.0.3 | 3.0.3 |
| gopkg.in/go-jose/go-jose.v2Go | v < 2.6.3 | 2.6.3 |
| gopkg.in/square/go-jose.v2Go | v ≤ 2.6.0, No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.