Skip to content
OpenAdvisories
High RHSA-2024:9181 2 CVEs

Red Hat Security Advisory: jose security update

Published Nov 13, 2024 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 9

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream jose 0:14-1.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream jose-debuginfo 0:14-1.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream jose-debugsource 0:14-1.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream libjose 0:14-1.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream libjose-debuginfo 0:14-1.el9
Red Hat · RHEL 9 enterprise_linux:9::crb jose-debuginfo 0:14-1.el9
Red Hat · RHEL 9 enterprise_linux:9::crb jose-debugsource 0:14-1.el9
Red Hat · RHEL 9 enterprise_linux:9::crb libjose-debuginfo 0:14-1.el9
Red Hat · RHEL 9 enterprise_linux:9::crb libjose-devel 0:14-1.el9

Vulnerabilities 2

  • High 7.5
    CVE-2023-50967

    latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka P…

    jose jose jose Debian Ubuntu Azure Linux
  • Medium 4.9
    CVE-2024-28176

    jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

    jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in t…

    panva jose sqlpad sqlpad-compat Ubuntu Wolfi npm

References

  • article
    https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index
  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2268820
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2270538
  • article
    https://issues.redhat.com/browse/RHEL-38079
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9181.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-50967
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-50967
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-50967
  • report
    https://access.redhat.com/security/cve/CVE-2024-28176
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-28176
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-28176
  • article
    https://github.com/panva/jose/security/advisories/GHSA-hhhv-q57g-882q