Most recent entries from all

ALSA-2024:3254 — Important: container-tools:rhel8 security update

Affected: AlmaLinux:8: aardvark-dns, AlmaLinux:8: buildah, AlmaLinux:8: buildah-tests, AlmaLinux:8: cockpit-podman, AlmaLinux:8: conmon, AlmaLinux:8: container-selinux, AlmaLinux:8: containernetworking-plugins, AlmaLinux:8: containers-common, AlmaLinux:8: crit, AlmaLinux:8: criu and 24 more

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

* buildah: full container escape at build time (CVE-2024-1753) * golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880) * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715) * golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786) * jose-go: improper handling of highly compressed data (CVE-2024-28180)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-01928

certfr-2024-avi-0514 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2024-avi-0514

CLEANSTART-2024-SY26301 — Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards

Affected: CleanStart: buildah

Security vulnerability affects the buildah package. Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards.

EUVD-2026-217366

fkie_cve-2024-28180

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

GHSA-c5q2-7r4c-mv6g — Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

Affected: Go: github.com/go-jose/go-jose/v4, Go: github.com/go-jose/go-jose/v3, Go: gopkg.in/go-jose/go-jose.v2, Go: gopkg.in/square/go-jose.v2

### Impact An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). Thanks to Enze Wang@Alioth and Jianjun Chen@Zhongguancun Lab (@zer0yu and @chenjj) for reporting.

### Patches The problem is fixed in the following packages and versions: - github.com/go-jose/go-jose/v4 version 4.0.1 - github.com/go-jose/go-jose/v3 version 3.0.3 - gopkg.in/go-jose/go-jose.v2 version 2.6.3

The problem will not be fixed in the following package because the package is archived: - gopkg.in/square/go-jose.v2

gsd-2024-28180

msrc_CVE-2024-28180 — Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

msrc_CVE-2024-28180

OESA-2024-1472 — cri-o security update

Affected: openEuler:22.03-LTS-SP1: cri-o

Open Container Initiative-based implementation of Kubernetes Container Runtime Interface. Security Fix(es): Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)

openSUSE-SU-2024:13905-1 — cmctl-1.14.5-1.1 on GA media

cmctl-1.14.5-1.1 on GA media

RHBA-2025:1772 — Red Hat Bug Fix Advisory: Updated 7.1 container image is now available in the Red Hat Ecosystem Catalog

golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON jose: resource exhaustion jose-go: improper handling of highly compressed data envoy: HTTP/2 CPU exhaustion due to CONTINUATION frame flood go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion keepalived: Integer overflow vulnerability in vrrp_ipsets_handler

SUSE-SU-2024:1987-2 — Security update for skopeo

Security update for skopeo

Withdrawn: UBUNTU-CVE-2024-28180

Withdrawn by the publisher.

Affected: Ubuntu:24.10: golang-github-go-jose-go-jose, Ubuntu:24.04:LTS: golang-github-go-jose-go-jose, Ubuntu:25.04: golang-github-go-jose-go-jose

WID-SEC-W-2024-0947 — Red Hat OpenShift: Mehrere Schwachstellen

Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder vertrauliche Informationen offenzulegen.