CVE-2024-28180

Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

View on CVE.org
Published Mar 9, 2024 CVSS 3.1 · 4.3 Medium EPSS 2.0% KEV · Not listed
Description
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2024-0896 Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.
Github GHSA Github GHSA GHSA-c5q2-7r4c-mv6g Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)
References
Link Providers
https://github.com/go-jose/go-jose/commit/0dd4dd541c665fb292d664f77604ba694726f298 cve-icon cve-icon
https://github.com/go-jose/go-jose/commit/add6a284ea0f844fd6628cba637be5451fe4b28a cve-icon cve-icon
https://github.com/go-jose/go-jose/commit/f4c051a0653d78199a053892f7619ebf96339502 cve-icon cve-icon
https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g cve-icon cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GD2GSBQTBLYADASUBHHZV2CZPTSLIPQJ/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IJ6LAJJ2FTA2JVVOACCV5RZTOIZLXUNJ/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JNPMXL36YGS3GQEVI3Q5HKHJ7YAAQXL5/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KXKGNCRU7OTM5AHC7YIYBNOWI742PRMY/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MSOMHDKRPU3A2JEMRODT2IREDFBLVPGS/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UG5FSEYJ3GP27FZXC5YAAMMEC5XWKJHG/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJO2U5ACZVACNQXJ5EBRFLFW6DP5BROY/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJDO5VSIAOGT2WP63AXAAWNRSVJCNCRH/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-28180 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-28180 cve-icon
History
Type Values Removed Values Added
First Time appeared Fedoraproject
Fedoraproject fedora
CPEs cpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
Vendors & Products Fedoraproject
Fedoraproject fedora
Type Values Removed Values Added
First Time appeared Go-jose Project
Go-jose Project go-jose
CPEs cpe:2.3:a:go-jose_project:go-jose:*:*:*:*:*:*:*:*
Vendors & Products Go-jose Project
Go-jose Project go-jose
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3. Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.
Type Values Removed Values Added
First Time appeared Redhat cert Manager
CPEs cpe:/a:redhat:cert_manager:1.15::el9
Vendors & Products Redhat cert Manager
Type Values Removed Values Added
First Time appeared Redhat acm
CPEs cpe:/a:redhat:acm:2.12::el9
Vendors & Products Redhat acm
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.17::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhmt:1.8::el8
Type Values Removed Values Added
CPEs cpe:/a:redhat:service_mesh:2.4::el8
Earlier changes (3)
Weaknesses

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Feb 13, 2025, 5:47 PM
Reserved
Mar 6, 2024, 5:35 PM

View source JSON

Updated
Aug 2, 2024, 12:48 AM

JSON

Status
Analyzed
Published
Mar 9, 2024, 1:15 AM
Modified
Jun 17, 2026, 7:21 AM

View source JSON

Severity
Moderate
Public date
Mar 9, 2024, 12:00 AM

View source Bugzilla JSON

No data.