Summary
Jose is a C-language implementation of the Javascript Object Signing and Encryption standards. The jose package is a dependency of the clevis and tang packages, together providing Network Bound Disk Encryption (NBDE) in AlmaLinux.
Security Fix(es):
* jose: resource exhaustion (CVE-2024-28176)
* jose: Denial of service due to uncontrolled CPU consumption (CVE-2023-50967)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | jose | 14-1.el9 |
| AlmaLinux · 9 | libjose | 14-1.el9 |
| AlmaLinux · 9 | libjose-devel | 14-1.el9 |
Vulnerabilities 2
-
High 7.5
latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka P…
-
Medium 4.9
jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext
jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in t…