Red Hat Security Advisory

RHSA-2024:3968

container-tools:rhel8 bug fix and enhancement update

Released 2024-06-18 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+21962+8143777b.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21962+8143777b.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21962+8143777b.s390x::container-tools:rhel8 +47

Fixes 2 records

TI-2024-18754 CVE-2024-28176 · GHSA-hhhv-q57g-882q

jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

LOW 31

jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.02102 Published 2024-03-09 Partial fix · 2.0.7, 4.15.5 CWE-400

TI-2024-18756 CVE-2024-28180 · GHSA-c5q2-7r4c-mv6g

Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

LOW 26

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01956 Published 2024-03-09 Partial fix · 4.0.1, 3.0.3 +1 CWE-409