Skip to content
OpenAdvisories
Medium RLSA-2024:5294 2 CVEs

Moderate: jose security update

Published May 7, 2025 · Updated May 7, 2025

Ecosystem: Rocky Linux

Summary

Jose is a C-language implementation of the Javascript Object Signing and Encryption standards. The jose package is a dependency of the clevis and tang packages, together providing Network Bound Disk Encryption (NBDE) in Rocky Linux.

Security Fix(es):

* jose: resource exhaustion (CVE-2024-28176)

* jose: Denial of service due to uncontrolled CPU consumption (CVE-2023-50967)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 8 jose 0:10-2.el8_10.3

Vulnerabilities 2

  • High 7.5
    CVE-2023-50967

    latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka P…

    jose jose jose Debian Ubuntu Azure Linux
  • Medium 4.9
    CVE-2024-28176

    jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

    jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in t…

    panva jose sqlpad sqlpad-compat Ubuntu Wolfi npm

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2268820
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2270538