Description
The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libjose4j-java | 0.9.6-1 | — |
| Debian 13 | libjose4j-java | 0.9.6-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libjose4j-java | No fix yet | — |
| Ubuntu 26.04 LTS | libjose4j-java | No fix yet | — |
| Ubuntu 25.10 | libjose4j-java | No fix yet | — |
| Ubuntu 24.04 LTS | libjose4j-java | No fix yet | — |
| Ubuntu 22.04 LTS | libjose4j-java | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.24-1.Final_redhat_00001.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-hibernate-validator +1 | 6.0.23-2.SP1_redhat_00001.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.5.18-1.Final_redhat_00001.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-jboss-cert-helper +1 | 1.1.3-1.redhat_00001.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.55-1.Final_redhat_00001.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-39.Final_redhat_00039.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-jbossws-cxf | 5.4.12-1.Final_redhat_00001.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-jsoup | 1.15.4-1.redhat_00003.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-undertow-jastow | 2.0.15-1.Final_redhat_00001.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.19-1.GA_redhat_00002.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk17 | 7.4.19-1.GA_redhat_00002.1.el8eap | RHSA-2024:8077, RHSA-2024:8076 |
| Red Hat JBoss EAP 7 | eap7-xalan-j2 | 2.7.1-37.redhat_00015.1.el7eap | RHSA-2024:8077, RHSA-2024:8076, RHSA-2024:8075 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Server Module 4.3 | cobbler | 3.3.3-150400.5.42.5 | SUSE-SU-2024:1507-1 |
| SUSE Manager Server Module 4.3 | image-sync-formula | 0.1.1711646883.4a44375-150400.3.18.4 | SUSE-SU-2024:1507-1 |
| SUSE Manager Server Module 4.3 | inter-server-sync | 0.3.3-150400.3.30.4 | SUSE-SU-2024:1507-1 |
| SUSE Manager Server Module 4.3 | jose4j | 0.5.1-150400.3.9.4 | SUSE-SU-2024:1507-1 |
| SUSE Manager Server Module 4.3 | smdba | 1.7.13-0.150400.4.12.4 | SUSE-SU-2024:1507-1 |
| SUSE Manager Server Module 4.3 | spacecmd | 4.3.27-150400.3.36.5 | SUSE-SU-2024:1507-1 |
| SUSE Manager Server Module 4.3 | spacewalk-backend | 4.3.28-150400.3.41.7 | SUSE-SU-2024:1507-1 |
| SUSE Manager Server Module 4.3 | spacewalk-certs-tools | 4.3.23-150400.3.28.5 | SUSE-SU-2024:1507-1 |
| SUSE Manager Server Module 4.3 | spacewalk-client-tools | 4.3.19-150400.3.27.5 | SUSE-SU-2024:1507-1 |
| SUSE Manager Server Module 4.3 | spacewalk-config | 4.3.13-150400.3.15.5 | SUSE-SU-2024:1507-1 |
| SUSE Manager Server Module 4.3 | spacewalk-java | 4.3.73-150400.3.79.1 | SUSE-SU-2024:1507-1 |
| SUSE Manager Server Module 4.3 | spacewalk-web | 4.3.38-150400.3.42.6 | SUSE-SU-2024:1507-1 |
| SUSE Manager Server Module 4.3 | subscription-matcher | 0.37-150400.3.22.4 | SUSE-SU-2024:1507-1 |
| SUSE Manager Server Module 4.3 | supportutils-plugin-susemanager | 4.3.11-150400.3.21.4 | SUSE-SU-2024:1507-1 |
| SUSE Manager Server Module 4.3 | susemanager | 4.3.35-150400.3.48.6 | SUSE-SU-2024:1507-1 |
| SUSE Manager Server Module 4.3 | susemanager-docs_en | 4.3-150400.9.56.4 | SUSE-SU-2024:1507-1 |
| SUSE Manager Server Module 4.3 | susemanager-schema | 4.3.25-150400.3.39.5 | SUSE-SU-2024:1507-1 |
| SUSE Manager Server Module 4.3 | susemanager-sls | 4.3.41-150400.3.47.6 | SUSE-SU-2024:1507-1 |
| SUSE Manager Server Module 4.3 | susemanager-sync-data | 4.3.17-150400.3.25.4 | SUSE-SU-2024:1507-1 |
| SUSE Manager Server Module 4.3 | uyuni-common-libs | 4.3.10-150400.3.18.4 | SUSE-SU-2024:1507-1 |
| SUSE Manager Server Module 4.3 | uyuni-reportdb-schema | 4.3.10-150400.3.15.6 | SUSE-SU-2024:1507-1 |
| SUSE Manager Server 4.3 | release-notes-susemanager | 4.3.12-150400.3.108.2 | SUSE-SU-2024:1532-1 |
| SUSE Manager Proxy Module 4.3 | mgr-daemon | 4.3.9-150400.3.15.5 | SUSE-SU-2024:1507-1 |
| SUSE Manager Proxy Module 4.3 | spacecmd | 4.3.27-150400.3.36.5 | SUSE-SU-2024:1507-1 |
| SUSE Manager Proxy Module 4.3 | spacewalk-backend | 4.3.28-150400.3.41.7 | SUSE-SU-2024:1507-1 |
| SUSE Manager Proxy Module 4.3 | spacewalk-certs-tools | 4.3.23-150400.3.28.5 | SUSE-SU-2024:1507-1 |
| SUSE Manager Proxy Module 4.3 | spacewalk-client-tools | 4.3.19-150400.3.27.5 | SUSE-SU-2024:1507-1 |
| SUSE Manager Proxy Module 4.3 | spacewalk-web | 4.3.38-150400.3.42.6 | SUSE-SU-2024:1507-1 |
| SUSE Manager Proxy Module 4.3 | uyuni-common-libs | 4.3.10-150400.3.18.4 | SUSE-SU-2024:1507-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Proxy 4.3 | release-notes-susemanager-proxy | 4.3.12-150400.3.82.3 | SUSE-SU-2024:1532-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | confluent-common-docker | 7.6.9-r0 | — |
| Wolfi rolling | confluent-kafka | 8.2.0.367-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.bitbucket.b_c:jose4j | < 0.9.4 | 0.9.4 | GHSA-6qvw-249j-h44c |
Advisories 19
- RHSA-2024:8077 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.19 Security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2024:8075 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.19 Security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2024:8076 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.19 Security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- WID-SEC-2024-3195 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- SUSE-SU-2024:1507-1 Security update for SUSE Manager Server 4.3 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:1532-1 Security update for SUSE Manager Server 4.3 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-3191 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 11, 2026
- WID-SEC-2024-0869 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 10, 2025
- WID-SEC-2025-0143 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 17, 2025
- NCSC-2025-0027 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Jan 22, 2025
- WID-SEC-2024-1642 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 20, 2024
- WID-SEC-2024-0797 IBM WebSphere Application Server: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 6, 2024
- WID-SEC-2024-3243 IBM SPSS: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Oct 20, 2024
- NCSC-2024-0417 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Oct 17, 2024
- NCSC-2024-0414 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Oct 17, 2024
- WID-SEC-2024-1549 Red Hat JBoss Enterprise Application Platform: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Oct 14, 2024
- NCSC-2024-0294 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jul 17, 2024
- WID-SEC-2024-1488 IBM InfoSphere Information Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 30, 2024
- WID-SEC-2024-1129 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 14, 2024