https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 13:26:35 +0000 https://cve.radiocsirt.org/vuln/alsa-2023:4411 <p><strong>Affected:</strong> AlmaLinux:9: cjose</p> <p>CJose is C library implementing the Javascript Object Signing and Encryption (JOSE).</p> <p>Security Fix(es):</p> <p>* cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE (CVE-2023-37464)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: cjose</p> <p>CJose is C library implementing the Javascript Object Signing and Encryption (JOSE).</p> <p>Security Fix(es):</p> <p>* cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE (CVE-2023-37464)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2023:4411 https://cve.radiocsirt.org/vuln/cleanstart-2024-iv40707 <p><strong>Affected:</strong> CleanStart: cjose</p> <p>Security vulnerability affects the cjose package. OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE).</p> <p><strong>Affected:</strong> CleanStart: cjose</p> <p>Security vulnerability affects the cjose package. OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE).</p> https://cve.radiocsirt.org/vuln/cleanstart-2024-iv40707 https://cve.radiocsirt.org/vuln/euvd-2026-216638 EUVD-2026-216638 https://cve.radiocsirt.org/vuln/euvd-2026-216638 https://cve.radiocsirt.org/vuln/fkie_cve-2023-37464 <p>OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a version &gt;= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm (e.g. AES CBC).</p> <p>OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a version &gt;= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm (e.g. AES CBC).</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-37464 https://cve.radiocsirt.org/vuln/gsd-2023-37464 gsd-2023-37464 https://cve.radiocsirt.org/vuln/gsd-2023-37464 https://cve.radiocsirt.org/vuln/msrc_cve-2023-37464 msrc_CVE-2023-37464 https://cve.radiocsirt.org/vuln/msrc_cve-2023-37464 https://cve.radiocsirt.org/vuln/oesa-2023-1441 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: cjose, openEuler:20.03-LTS-SP3: cjose, openEuler:22.03-LTS: cjose, openEuler:22.03-LTS-SP1: cjose, openEuler:22.03-LTS-SP2: cjose</p> <p>Implementation of JOSE for C/C++</p> <p>Security Fix(es):</p> <p>OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a version &amp;gt;= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm (e.g. AES CBC).(CVE-2023-37464)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: cjose, openEuler:20.03-LTS-SP3: cjose, openEuler:22.03-LTS: cjose, openEuler:22.03-LTS-SP1: cjose, openEuler:22.03-LTS-SP2: cjose</p> <p>Implementation of JOSE for C/C++</p> <p>Security Fix(es):</p> <p>OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a version &amp;gt;= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm (e.g. AES CBC).(CVE-2023-37464)</p> https://cve.radiocsirt.org/vuln/oesa-2023-1441 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13052-1 <p>libcjose-devel-0.6.2.2-1.1 on GA media</p> <p>libcjose-devel-0.6.2.2-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:13052-1 https://cve.radiocsirt.org/vuln/rhsa-2023:4408 <p>cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE</p> <p>cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE</p> https://cve.radiocsirt.org/vuln/rhsa-2023:4408 https://cve.radiocsirt.org/vuln/suse-su-2023:3030-1 <p>Security update for cjose</p> <p>Security update for cjose</p> https://cve.radiocsirt.org/vuln/suse-su-2023:3030-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-37464 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: cjose, Ubuntu:20.04:LTS: cjose, Ubuntu:22.04:LTS: cjose, Ubuntu:24.04:LTS: cjose, Ubuntu:25.10: cjose, Ubuntu:26.04:LTS: cjose</p> <p>OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a version &gt;= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm (e.g. AES CBC).</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: cjose, Ubuntu:20.04:LTS: cjose, Ubuntu:22.04:LTS: cjose, Ubuntu:24.04:LTS: cjose, Ubuntu:25.10: cjose, Ubuntu:26.04:LTS: cjose</p> <p>OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a version &gt;= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm (e.g. AES CBC).</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-37464 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1940 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1940