Skip to content
OpenAdvisories
Medium ELSA-2024-9181 2 CVEs

Moderate: jose security update (Oracle Linux 9)

Published Nov 14, 2024 · Updated Nov 14, 2024

Ecosystem: Oracle Linux

Summary

[14-1]
- Rebase jose-14 upstream version
Resolves: #RHEL-38079

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 9 jose 0:14-1.el9
Oracle Linux · 9 libjose 0:14-1.el9
Oracle Linux · 9 libjose-devel 0:14-1.el9

Vulnerabilities 2

  • High 7.5
    CVE-2023-50967

    latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka P…

    jose jose jose Debian Ubuntu Azure Linux
  • Medium 4.9
    CVE-2024-28176

    jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

    jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in t…

    panva jose sqlpad sqlpad-compat Ubuntu Wolfi npm