Red Hat Security Advisory

RHSA-2024:9181

jose security update

Released 2024-11-12 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder (v. 9) libjose-devel-14-1.el9
Red Hat Enterprise Linux AppStream (v. 9) jose-14-1.el9, libjose-14-1.el9

Fixes 2 records

TI-2023-27858 CVE-2023-50967 · GHSA-5rrv-52wj-qgfg

latchset jose through version 11 allows attackers to cause a denial of service (CPU…

HIGH 66

latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01383 Published 2024-03-20 Partial fix CWE-400

TI-2024-18754 CVE-2024-28176 · GHSA-hhhv-q57g-882q

jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

LOW 31

jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.02102 Published 2024-03-09 Partial fix · 2.0.7, 4.15.5 CWE-400