Most recent entries from all

ALSA-2024:3826 — Moderate: podman security and bug fix update

Affected: AlmaLinux:9: podman, AlmaLinux:9: podman-docker, AlmaLinux:9: podman-plugins, AlmaLinux:9: podman-remote, AlmaLinux:9: podman-tests

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fixes:

* podman: jose-go: improper handling of highly compressed data (CVE-2024-28180) * podman: golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290) * podman: jose: resource exhaustion (CVE-2024-28176)

bdu:2024-01954

certfr-2024-avi-0579 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2024-avi-0579

EUVD-2026-217365

fkie_cve-2024-28176

jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.

GHSA-hhhv-q57g-882q — jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

Affected: npm: jose, npm: jose-node-cjs-runtime, npm: jose-node-esm-runtime

A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the [support for decompressing plaintext after its decryption](https://www.rfc-editor.org/rfc/rfc7516.html#section-4.1.3). This allows an adversary to exploit specific scenarios where the compression ratio becomes exceptionally high. As a result, the length of the JWE token, which is determined by the compressed content's size, can land below application-defined limits. In such cases, other existing application level mechanisms for preventing resource exhaustion may be rendered ineffective.

Note that as per [RFC 8725](https://www.rfc-editor.org/rfc/rfc8725.html#name-avoid-compression-of-encryp) compression of data SHOULD NOT be done before encryption, because such compressed data often reveals information about the plaintext. For this reason the v5.x major version of `jose` removed support for compressed payloads entirely and is therefore NOT affected by this advisory.

### Impact

Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations.

### Affected users

The impact is limited only to Node.js users utilizing the JWE decryption APIs to decrypt JWEs from untrusted sources.

You are NOT affected if any of the following applies to you

- Your code uses jose version v5.x where JWE Compression is not supported anymore - Your code runs in an environment other than Nod…

gsd-2024-28176

OESA-2025-1075 — podman security update

Affected: openEuler:24.03-LTS: podman

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library. Security Fix(es):

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.(CVE-2024-24785)

RHBA-2024:1775 — Red Hat Bug Fix Advisory: Multicluster Engine for Kubernetes 2.5.2 bug fixes and container updates

sanitize-html: Information Exposure when used on the backend jose: resource exhaustion

RHSA-2024:3826 — Red Hat Security Advisory: podman security and bug fix update

golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm jose: resource exhaustion jose-go: improper handling of highly compressed data

UBUNTU-CVE-2024-28176

Affected: Ubuntu:22.04:LTS: node-jose, Ubuntu:24.04:LTS: node-jose, Ubuntu:25.10: node-jose

WID-SEC-W-2024-0767 — IBM App Connect Enterprise: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial-of-Service-Zustand zu verursachen.