Vulnerability · Published Mar 9, 2024 · Assigned by GitHub_M
CVE-2024-28180Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)
Medium 4.3
In plain English
A medium-severity security flaw in go-jose from go-jose. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)2.0%top 19.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | aardvark-dns | 2:1.10.0-1.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | aardvark-dns | 2:1.10.0-1.module_el8.10.0+3792+03eaed9c | ALSA-2024:3254 |
| AlmaLinux:8 | aardvark-dns | 2:1.10.0-1.module_el8.10.0+3792+03eaed9c | ALSA-2024:3968 |
| AlmaLinux:8 | buildah | 2:1.33.7-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:8 | buildah | 2:1.33.7-2.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:9 | buildah | 2:1.33.7-2.el9_4 | ALSA-2024:3827 |
| AlmaLinux:8 | buildah-tests | 2:1.33.7-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:8 | buildah-tests | 2:1.33.7-2.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:9 | buildah-tests | 2:1.33.7-2.el9_4 | ALSA-2024:3827 |
| AlmaLinux:8 | cockpit-podman | 84.1-1.module_el8.10.0+3792+03eaed9c | ALSA-2024:3254 |
| AlmaLinux:8 | cockpit-podman | 84.1-1.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | conmon | 3:2.1.10-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux:8 | conmon | 3:2.1.10-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:8 | conmon | 3:2.1.10-1.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | container-selinux | 2:2.229.0-2.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | container-selinux | 2:2.229.0-2.module_el8.10.0+3792+03eaed9c | ALSA-2024:3254 |
| AlmaLinux:8 | containernetworking-plugins | 1:1.4.0-2.module_el8.10.0+3792+03eaed9c | ALSA-2024:3254 |
| AlmaLinux:8 | containernetworking-plugins | 1:1.4.0-2.module_el8.10.0+3792+03eaed9c | ALSA-2024:3968 |
| AlmaLinux:8 | containernetworking-plugins | 1:1.4.0-2.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | containers-common | 2:1-81.module_el8.10.0+3792+03eaed9c | ALSA-2024:3254 |
| AlmaLinux:8 | containers-common | 2:1-81.module_el8.10.0+3792+03eaed9c | ALSA-2024:3968 |
| AlmaLinux:8 | containers-common | 2:1-81.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | crit | 3.18-5.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux:8 | crit | 3.18-5.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:8 | crit | 3.18-5.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | criu | 3.18-5.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux:8 | criu | 3.18-5.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | criu | 3.18-5.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:8 | criu-devel | 3.18-5.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | criu-devel | 3.18-5.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:8 | criu-libs | 3.18-5.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux:8 | criu-libs | 3.18-5.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:8 | crun | 1.14.3-2.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux:8 | crun | 1.14.3-2.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | crun | 1.14.3-2.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:8 | fuse-overlayfs | 1.13-1.module_el8.10.0+3792+03eaed9c | ALSA-2024:3254 |
| AlmaLinux:8 | fuse-overlayfs | 1.13-1.module_el8.10.0+3792+03eaed9c | ALSA-2024:3968 |
| AlmaLinux:8 | libslirp | 4.4.0-2.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux:8 | libslirp | 4.4.0-2.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:8 | libslirp | 4.4.0-2.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | libslirp-devel | 4.4.0-2.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:8 | libslirp-devel | 4.4.0-2.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | libslirp-devel | 4.4.0-2.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux:8 | netavark | 2:1.10.3-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:8 | netavark | 2:1.10.3-1.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | netavark | 2:1.10.3-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 1.2.10-1.module_el8.10.0+3792+03eaed9c | ALSA-2024:3968 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 1.2.10-1.module_el8.10.0+3792+03eaed9c | ALSA-2024:3254 |
| AlmaLinux:8 | podman | 4:4.9.4-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:8 | podman | 4:4.9.4-3.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:9 | podman | 4:4.9.4-4.el9_4 | ALSA-2024:3826 |
| AlmaLinux:8 | podman-catatonit | 4:4.9.4-3.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | podman-catatonit | 4:4.9.4-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:8 | podman-docker | 4:4.9.4-3.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | podman-docker | 4:4.9.4-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:9 | podman-docker | 4:4.9.4-4.el9_4 | ALSA-2024:3826 |
| AlmaLinux:8 | podman-gvproxy | 4:4.9.4-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:8 | podman-gvproxy | 4:4.9.4-3.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | podman-plugins | 4:4.9.4-3.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | podman-plugins | 4:4.9.4-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:9 | podman-plugins | 4:4.9.4-4.el9_4 | ALSA-2024:3826 |
| AlmaLinux:8 | podman-remote | 4:4.9.4-3.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | podman-remote | 4:4.9.4-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:9 | podman-remote | 4:4.9.4-4.el9_4 | ALSA-2024:3826 |
| AlmaLinux:8 | podman-tests | 4:4.9.4-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:8 | podman-tests | 4:4.9.4-3.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:9 | podman-tests | 4:4.9.4-4.el9_4 | ALSA-2024:3826 |
| AlmaLinux:8 | python3-criu | 3.18-5.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux:8 | python3-criu | 3.18-5.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | python3-criu | 3.18-5.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:8 | python3-podman | 4.9.0-1.module_el8.10.0+3792+03eaed9c | ALSA-2024:3254 |
| AlmaLinux:8 | python3-podman | 4.9.0-1.module_el8.10.0+3792+03eaed9c | ALSA-2024:3968 |
| AlmaLinux:8 | runc | 1:1.1.12-1.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | runc | 1:1.1.12-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux:8 | runc | 1:1.1.12-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:8 | skopeo | 2:1.14.3-2.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:8 | skopeo | 2:1.14.3-2.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux:8 | skopeo | 2:1.14.3-2.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:9 | skopeo | 2:1.14.3-2.el9_4 | ALSA-2024:2549 |
| AlmaLinux:8 | skopeo-tests | 2:1.14.3-2.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:8 | skopeo-tests | 2:1.14.3-2.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | skopeo-tests | 2:1.14.3-2.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux:9 | skopeo-tests | 2:1.14.3-2.el9_4 | ALSA-2024:2549 |
| AlmaLinux:8 | slirp4netns | 1.2.3-1.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | slirp4netns | 1.2.3-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:8 | slirp4netns | 1.2.3-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux:8 | toolbox | 0.0.99.5-2.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | toolbox | 0.0.99.5-2.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux:8 | toolbox | 0.0.99.5-2.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:8 | toolbox-tests | 0.0.99.5-2.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | toolbox-tests | 0.0.99.5-2.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| AlmaLinux:8 | toolbox-tests | 0.0.99.5-2.module_el8.10.0+3845+87b84552 | ALSA-2024:3968 |
| AlmaLinux:8 | udica | 0.2.6-21.module_el8.10.0+3858+6ad51f9f | ALSA-2024:3968 |
| AlmaLinux:8 | udica | 0.2.6-21.module_el8.10.0+3845+87b84552 | ALSA-2024:3254 |
| Alpine:v3.20 | buildah | 1.35.4-r0 | ALPINE-CVE-2024-28180 |
| Alpine:v3.21 | buildah | 1.35.4-r0 | ALPINE-CVE-2024-28180 |
| Alpine:v3.22 | buildah | 1.35.4-r0 | ALPINE-CVE-2024-28180 |
| Alpine:v3.23 | buildah | 1.35.4-r0 | ALPINE-CVE-2024-28180 |
| Alpine:v3.24 | buildah | 1.35.4-r0 | ALPINE-CVE-2024-28180 |
| Debian:13 | golang-github-go-jose-go-jose | 4.0.1-1 | DEBIAN-CVE-2024-28180 |
| Debian:14 | golang-github-go-jose-go-jose | 4.0.1-1 | DEBIAN-CVE-2024-28180 |
| Debian:12 | golang-gopkg-square-go-jose.v2 | no fix listed | DEBIAN-CVE-2024-28180 |
| Debian:13 | golang-gopkg-square-go-jose.v2 | 2.6.3-1 | DEBIAN-CVE-2024-28180 |
| Debian:14 | golang-gopkg-square-go-jose.v2 | 2.6.3-1 | DEBIAN-CVE-2024-28180 |
| Go | github.com/go-jose/go-jose/v3 | 3.0.3 | GO-2024-2631 |
| Go | github.com/go-jose/go-jose/v3 | 3.0.3 | GHSA-c5q2-7r4c-mv6g |
| Go | github.com/go-jose/go-jose/v4 | 4.0.1 | GHSA-c5q2-7r4c-mv6g |
| Go | github.com/go-jose/go-jose/v4 | 4.0.1 | GO-2024-2631 |
| Go | gopkg.in/go-jose/go-jose.v2 | 2.6.3 | GHSA-c5q2-7r4c-mv6g |
| Go | gopkg.in/go-jose/go-jose.v2 | 2.6.3 | GO-2024-2631 |
| Go | gopkg.in/square/go-jose.v2 | no fix listed | GO-2024-2631 |
| Go | gopkg.in/square/go-jose.v2 | no fix listed | GHSA-c5q2-7r4c-mv6g |
| Rocky Linux:8 | aardvark-dns | 2:1.10.0-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux:8 | buildah | 2:1.33.7-2.module+el8.10.0+1829+9bb2696f | RLSA-2024:3968 |
| Rocky Linux:9 | buildah | 2:1.33.7-2.el9_4 | RLSA-2024:3827 |
| Rocky Linux:8 | cockpit-podman | 0:84.1-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux:8 | conmon | 3:2.1.10-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux:8 | container-selinux | 2:2.229.0-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux:8 | containernetworking-plugins | 1:1.4.0-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux:8 | containers-common | 2:1-81.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux:8 | criu | 0:3.18-5.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux:8 | crun | 0:1.14.3-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux:8 | fuse-overlayfs | 0:1.13-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux:8 | libslirp | 0:4.4.0-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux:8 | netavark | 2:1.10.3-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux:8 | oci-seccomp-bpf-hook | 0:1.2.10-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux:8 | podman | 4:4.9.4-3.module+el8.10.0+1829+9bb2696f | RLSA-2024:3968 |
| Rocky Linux:9 | podman | 4:4.9.4-4.el9_4 | RLSA-2024:3826 |
| Rocky Linux:8 | python-podman | 0:4.9.0-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux:8 | runc | 1:1.1.12-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux:8 | skopeo | 2:1.14.3-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux:9 | skopeo | 2:1.14.3-2.el9_4 | RLSA-2024:2549 |
| Rocky Linux:8 | slirp4netns | 0:1.2.3-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux:8 | toolbox | 0:0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2 | RLSA-2024:3968 |
| Rocky Linux:8 | udica | 0:0.2.6-21.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
Affected products (as reported)
Weakness: CWE-409 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
References
- https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g x_refsource_CONFIRM
- https://github.com/go-jose/go-jose/commit/0dd4dd541c665fb292d664f77604ba694726f298 x_refsource_MISC
- https://github.com/go-jose/go-jose/commit/add6a284ea0f844fd6628cba637be5451fe4b28a x_refsource_MISC
- https://github.com/go-jose/go-jose/commit/f4c051a0653d78199a053892f7619ebf96339502 x_refsource_MISC
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJDO5VSIAOGT2WP63AXAAWNRSVJCNCRH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KXKGNCRU7OTM5AHC7YIYBNOWI742PRMY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJO2U5ACZVACNQXJ5EBRFLFW6DP5BROY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UG5FSEYJ3GP27FZXC5YAAMMEC5XWKJHG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IJ6LAJJ2FTA2JVVOACCV5RZTOIZLXUNJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JNPMXL36YGS3GQEVI3Q5HKHJ7YAAQXL5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MSOMHDKRPU3A2JEMRODT2IREDFBLVPGS/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GD2GSBQTBLYADASUBHHZV2CZPTSLIPQJ/