Description
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| go-jose | go-jose | < 4.0.1, < 3.0.3, < 2.6.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-go-jose-go-jose | 4.0.1-1 | — |
| Debian 14 | golang-gopkg-square-go-jose.v2 | 2.6.3-1 | — |
| Debian 13 | golang-github-go-jose-go-jose | 4.0.1-1 | — |
| Debian 13 | golang-gopkg-square-go-jose.v2 | 2.6.3-1 | — |
| Debian 12 | golang-gopkg-square-go-jose.v2 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | buildah +1 | 2:1.33.7-2.el9_4 | RHSA-2024:3827 |
| RHEL 9 | podman +4 | 4:4.9.4-4.el9_4 | RHSA-2024:3826 |
| RHEL 9 | skopeo +1 | 2:1.14.3-2.el9_4 | RHSA-2024:2549 |
| RHEL 8 | aardvark-dns | 2:1.10.0-1.module+el8.10.0+21209+52deeb51 | RHSA-2024:3968, RHSA-2024:3254 |
| RHEL 8 | buildah +1 | 2:1.33.7-1.module+el8.10.0+21590+d7d75709 | RHSA-2024:3968, RHSA-2024:3254 |
| RHEL 8 | cockpit-podman | 84.1-1.module+el8.10.0+21373+0d273fdf | RHSA-2024:3968, RHSA-2024:3254 |
| RHEL 8 | conmon | 3:2.1.10-1.module+el8.10.0+21077+98b84d8a | RHSA-2024:3968, RHSA-2024:3254 |
| RHEL 8 | container-selinux | 2:2.229.0-2.module+el8.10.0+21196+3f0abbca | RHSA-2024:3968, RHSA-2024:3254 |
| RHEL 8 | containernetworking-plugins | 1:1.4.0-2.module+el8.10.0+21366+f9cb49f8 | RHSA-2024:3968, RHSA-2024:3254 |
| RHEL 8 | containers-common | 2:1-81.module+el8.10.0+21340+c6c7475a | RHSA-2024:3968, RHSA-2024:3254 |
| RHEL 8 | crit +4 | 3.18-5.module+el8.10.0+21672+01ba06ae | RHSA-2024:3968, RHSA-2024:3254 |
| RHEL 8 | crun | 1.14.3-2.module+el8.10.0+21340+c6c7475a | RHSA-2024:3968, RHSA-2024:3254 |
| RHEL 8 | fuse-overlayfs | 1.13-1.module+el8.10.0+20412+95ee28e2 | RHSA-2024:3968, RHSA-2024:3254 |
| RHEL 8 | libslirp +1 | 4.4.0-2.module+el8.10.0+21672+01ba06ae | RHSA-2024:3968, RHSA-2024:3254 |
| RHEL 8 | netavark | 2:1.10.3-1.module+el8.10.0+21306+6be40ce7 | RHSA-2024:3968, RHSA-2024:3254 |
| RHEL 8 | oci-seccomp-bpf-hook | 1.2.10-1.module+el8.10.0+20565+a40ba0e5 | RHSA-2024:3968, RHSA-2024:3254 |
| RHEL 8 | podman +6 | 4:4.9.4-1.module+el8.10.0+21632+761e0d34 | RHSA-2024:3968, RHSA-2024:3254 |
| RHEL 8 | python-podman +1 | 4.9.0-1.module+el8.10.0+21196+3f0abbca | RHSA-2024:3968, RHSA-2024:3254 |
| RHEL 8 | runc | 1:1.1.12-1.module+el8.10.0+21251+62b7388c | RHSA-2024:3968, RHSA-2024:3254 |
| RHEL 8 | skopeo +1 | 2:1.14.3-2.module+el8.10.0+21728+a1d9b0ab | RHSA-2024:3968, RHSA-2024:3254 |
| RHEL 8 | slirp4netns | 1.2.3-1.module+el8.10.0+21306+6be40ce7 | RHSA-2024:3968, RHSA-2024:3254 |
| RHEL 8 | toolbox +1 | 0.0.99.5-2.module+el8.10.0+21341+ff0b5f89 | RHSA-2024:3968, RHSA-2024:3254 |
| RHEL 8 | udica | 0.2.6-21.module+el8.10.0+21672+01ba06ae | RHSA-2024:3968, RHSA-2024:3254 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Openshift Pipelines 1 | openshift-pipelines-client +1 | 1.15.0-11496.el8 | RHEA-2024:4022 |
| Red Hat OpenShift 4 | buildah +1 | 1:1.23.4-5.2.rhaos4.12.el8 | RHSA-2024:1574, RHSA-2024:1563 |
| Red Hat OpenShift 4 | butane +1 | 0.16.0-2.2.rhaos4.12.el8 | RHSA-2024:1574, RHSA-2024:1567, RHSA-2024:1563 |
| Red Hat OpenShift 4 | containernetworking-plugins | 1:1.4.0-1.1.rhaos4.12.el8 | RHSA-2024:1574, RHSA-2024:1567, RHSA-2024:1563 |
| Red Hat OpenShift 4 | cri-o | 1.25.3-5.2.rhaos4.12.git44a2cb2.el9 | RHSA-2024:3351, RHSA-2024:2877, RHSA-2024:2784 |
| Red Hat OpenShift 4 | cri-tools | 1.25.0-2.2.el8 | RHSA-2024:1574, RHSA-2024:1567, RHSA-2024:1563 |
| Red Hat OpenShift 4 | ignition +1 | 2.14.0-5.2.rhaos4.12.el9 | RHSA-2024:1574, RHSA-2024:1567, RHSA-2024:1563 |
| Red Hat OpenShift 4 | openshift +1 | 4.13.0-202404222036.p0.g4818370.assembly.stream.el8 | RHSA-2024:2672, RHSA-2024:2054, RHSA-2024:2049 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.12.0-202403251017.p0.gd4c9e3c.assembly.stream.el8 | RHSA-2024:2776, RHSA-2024:1574, RHSA-2024:1567 |
| Red Hat OpenShift 4 | ose-aws-ecr-image-credential-provider | 4.14.0-202403251040.p0.g607e2dd.assembly.stream.el8 | RHSA-2024:1567, RHSA-2024:1563 |
| Red Hat OpenShift 4 | podman +6 | 3:4.2.0-7.2.rhaos4.12.el9 | RHSA-2024:3351, RHSA-2024:2877, RHSA-2024:2784 |
| Red Hat OpenShift 4 | runc | 3:1.1.6-5.2.rhaos4.12.el8 | RHSA-2024:1574, RHSA-2024:1563 |
| Red Hat OpenShift 4 | skopeo +1 | 2:1.9.4-3.2.rhaos4.12.el8 | RHSA-2024:2784, RHSA-2024:2071, RHSA-2024:2054 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | buildah +1 | 2:1.33.7-2.el9_4 | ALSA-2024:3827 |
| AlmaLinux 9 | podman +4 | 4:4.9.4-4.el9_4 | ALSA-2024:3826 |
| AlmaLinux 9 | skopeo +1 | 2:1.14.3-2.el9_4 | ALSA-2024:2549 |
| AlmaLinux 8 | aardvark-dns | 2:1.10.0-1.module_el8.10.0+3792+03eaed9c | ALSA-2024:3968, ALSA-2024:3254 |
| AlmaLinux 8 | buildah +1 | 2:1.33.7-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3968, ALSA-2024:3254 |
| AlmaLinux 8 | cockpit-podman | 84.1-1.module_el8.10.0+3792+03eaed9c | ALSA-2024:3968, ALSA-2024:3254 |
| AlmaLinux 8 | conmon | 3:2.1.10-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3968, ALSA-2024:3254 |
| AlmaLinux 8 | container-selinux | 2:2.229.0-2.module_el8.10.0+3792+03eaed9c | ALSA-2024:3968, ALSA-2024:3254 |
| AlmaLinux 8 | containernetworking-plugins | 1:1.4.0-2.module_el8.10.0+3792+03eaed9c | ALSA-2024:3968, ALSA-2024:3254 |
| AlmaLinux 8 | containers-common | 2:1-81.module_el8.10.0+3792+03eaed9c | ALSA-2024:3968, ALSA-2024:3254 |
| AlmaLinux 8 | crit +4 | 3.18-5.module_el8.10.0+3845+87b84552 | ALSA-2024:3968, ALSA-2024:3254 |
| AlmaLinux 8 | crun | 1.14.3-2.module_el8.10.0+3845+87b84552 | ALSA-2024:3968, ALSA-2024:3254 |
| AlmaLinux 8 | fuse-overlayfs | 1.13-1.module_el8.10.0+3792+03eaed9c | ALSA-2024:3968, ALSA-2024:3254 |
| AlmaLinux 8 | libslirp +1 | 4.4.0-2.module_el8.10.0+3845+87b84552 | ALSA-2024:3968, ALSA-2024:3254 |
| AlmaLinux 8 | netavark | 2:1.10.3-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3968, ALSA-2024:3254 |
| AlmaLinux 8 | oci-seccomp-bpf-hook | 1.2.10-1.module_el8.10.0+3792+03eaed9c | ALSA-2024:3968, ALSA-2024:3254 |
| AlmaLinux 8 | podman +6 | 4:4.9.4-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3968, ALSA-2024:3254 |
| AlmaLinux 8 | python3-podman | 4.9.0-1.module_el8.10.0+3792+03eaed9c | ALSA-2024:3968, ALSA-2024:3254 |
| AlmaLinux 8 | runc | 1:1.1.12-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3968, ALSA-2024:3254 |
| AlmaLinux 8 | skopeo +1 | 2:1.14.3-2.module_el8.10.0+3845+87b84552 | ALSA-2024:3968, ALSA-2024:3254 |
| AlmaLinux 8 | slirp4netns | 1.2.3-1.module_el8.10.0+3845+87b84552 | ALSA-2024:3968, ALSA-2024:3254 |
| AlmaLinux 8 | toolbox +1 | 0.0.99.5-2.module_el8.10.0+3845+87b84552 | ALSA-2024:3968, ALSA-2024:3254 |
| AlmaLinux 8 | udica | 0.2.6-21.module_el8.10.0+3845+87b84552 | ALSA-2024:3968, ALSA-2024:3254 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | buildah | 2:1.33.7-2.el9_4 | RLSA-2024:3827 |
| Rocky Linux 9 | podman | 4:4.9.4-4.el9_4 | RLSA-2024:3826 |
| Rocky Linux 9 | skopeo | 2:1.14.3-2.el9_4 | RLSA-2024:2549 |
| Rocky Linux 8 | aardvark-dns | 2:1.10.0-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | buildah | 2:1.33.7-2.module+el8.10.0+1829+9bb2696f | RLSA-2024:3968 |
| Rocky Linux 8 | cockpit-podman | 84.1-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | conmon | 3:2.1.10-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | container-selinux | 2:2.229.0-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | containernetworking-plugins | 1:1.4.0-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | containers-common | 2:1-81.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | criu | 3.18-5.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | crun | 1.14.3-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | fuse-overlayfs | 1.13-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | libslirp | 4.4.0-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | netavark | 2:1.10.3-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | oci-seccomp-bpf-hook | 1.2.10-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | podman | 4:4.9.4-3.module+el8.10.0+1829+9bb2696f | RLSA-2024:3968 |
| Rocky Linux 8 | python-podman | 4.9.0-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | runc | 1:1.1.12-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | skopeo | 2:1.14.3-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | slirp4netns | 1.2.3-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
| Rocky Linux 8 | toolbox | 0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2 | RLSA-2024:3968 |
| Rocky Linux 8 | udica | 0.2.6-21.module+el8.10.0+1815+5fe7415e | RLSA-2024:3968 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | apptainer | 1.3.6-150600.4.3.1 | SUSE-SU-2025:0066-1 |
| SLES 15 SP6 | buildah | 1.35.4-150500.3.10.1 | SUSE-SU-2024:3151-1 |
| SLES 15 SP6 | docker | 25.0.6_ce-150000.207.1 | SUSE-SU-2024:3120-1 |
| SLES 15 SP6 | grafana | 10.4.15-150200.3.64.1 | SUSE-SU-2025:0623-1 |
| SLES 15 SP6 | skopeo | 1.14.4-150300.11.11.1 | SUSE-SU-2024:1987-1 |
| SLES 15 SP5 | buildah | 1.35.4-150500.3.10.1 | SUSE-SU-2024:3151-1 |
| SLES 15 SP5 | docker | 25.0.6_ce-150000.207.1 | SUSE-SU-2024:3120-1 |
| SLES 15 SP5 | skopeo | 1.14.4-150300.11.11.1 | SUSE-SU-2024:1987-1 |
| SLES 15 SP4 | buildah | 1.35.4-150400.3.30.1 | SUSE-SU-2024:3186-1 |
| SLES 15 SP4 | docker | 25.0.6_ce-150000.207.1 | SUSE-SU-2024:3120-1 |
| SLES 15 SP4 | skopeo | 1.14.4-150300.11.11.1 | SUSE-SU-2024:1987-1 |
| SLES 15 SP3 | buildah | 1.35.4-150300.8.25.1 | SUSE-SU-2024:3120-1 |
| SLES 15 SP3 | docker | 25.0.6_ce-150000.207.1 | SUSE-SU-2024:3120-1 |
| SLES 15 SP3 | skopeo | 1.14.4-150300.11.11.1 | SUSE-SU-2024:1987-1 |
| SLES 15 SP2 | docker | 25.0.6_ce-150000.207.1 | SUSE-SU-2024:3120-1 |
| SLES 15 SP2 | libgpg-error | 1.29-150000.3.3.1 | SUSE-SU-2024:2754-1 |
| SLES 15 SP2 | skopeo | 1.14.4-150000.4.26.1 | SUSE-SU-2024:2754-1 |
Show 17 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP4 | buildah | 1.35.4-150400.3.30.1 | SUSE-SU-2024:3186-1 |
| SLES for SAP 15 SP4 | docker | 25.0.6_ce-150000.207.1 | SUSE-SU-2024:3120-1 |
| SLES for SAP 15 SP4 | skopeo | 1.14.4-150300.11.11.1 | SUSE-SU-2024:1987-1 |
| SLES for SAP 15 SP3 | buildah | 1.35.4-150300.8.25.1 | SUSE-SU-2024:3120-1 |
| SLES for SAP 15 SP3 | docker | 25.0.6_ce-150000.207.1 | SUSE-SU-2024:3120-1 |
| SLES for SAP 15 SP3 | skopeo | 1.14.4-150300.11.11.1 | SUSE-SU-2024:1987-1 |
| SLES for SAP 15 SP2 | docker | 25.0.6_ce-150000.207.1 | SUSE-SU-2024:3120-1 |
| SLES for SAP 15 SP2 | libgpg-error | 1.29-150000.3.3.1 | SUSE-SU-2024:2754-1 |
| SLES for SAP 15 SP2 | skopeo | 1.14.4-150000.4.26.1 | SUSE-SU-2024:2754-1 |
| SLE Micro 6.0 | skopeo | 1.14.4-1.1 | SUSE-SU-2025:20019-1 |
| SLE Micro 5.5 | docker | 25.0.6_ce-150000.207.1 | SUSE-SU-2024:3120-1 |
| SLE Micro 5.5 | skopeo | 1.14.4-150300.11.11.1 | SUSE-SU-2024:1987-2, SUSE-SU-2024:1987-1 |
| SLE Micro 5.4 | docker | 25.0.6_ce-150000.207.1 | SUSE-SU-2024:3120-1 |
| SLE Micro 5.3 | docker | 25.0.6_ce-150000.207.1 | SUSE-SU-2024:3120-1 |
| SLE Micro 5.2 | docker | 25.0.6_ce-150000.207.1 | SUSE-SU-2024:3120-1 |
| SLE Micro 5.1 | docker | 25.0.6_ce-150000.207.1 | SUSE-SU-2024:3120-1 |
| SLE HPC 15 SP4 | buildah | 1.35.4-150400.3.30.1 | SUSE-SU-2024:3186-1 |
| SLE HPC 15 SP4 | docker | 25.0.6_ce-150000.207.1 | SUSE-SU-2024:3120-1 |
| SLE HPC 15 SP4 | skopeo | 1.14.4-150300.11.11.1 | SUSE-SU-2024:1987-1 |
| SLE HPC 15 SP3 | buildah | 1.35.4-150300.8.25.1 | SUSE-SU-2024:3120-1 |
| SLE HPC 15 SP3 | docker | 25.0.6_ce-150000.207.1 | SUSE-SU-2024:3120-1 |
| SLE HPC 15 SP3 | skopeo | 1.14.4-150300.11.11.1 | SUSE-SU-2024:1987-1 |
| SLE HPC 15 SP2 | docker | 25.0.6_ce-150000.207.1 | SUSE-SU-2024:3120-1 |
| SLE HPC 15 SP2 | libgpg-error | 1.29-150000.3.3.1 | SUSE-SU-2024:2754-1 |
| SLE HPC 15 SP2 | skopeo | 1.14.4-150000.4.26.1 | SUSE-SU-2024:2754-1 |
| SUSE Manager Server 4.3 | skopeo | 1.14.4-150300.11.11.1 | SUSE-SU-2024:1987-1 |
| SUSE Manager Proxy 4.3 | skopeo | 1.14.4-150300.11.11.1 | SUSE-SU-2024:1987-1 |
| SUSE Manager Client Tools 15 | grafana | 10.4.15-150000.1.71.1 | SUSE-SU-2025:0624-1 |
| SUSE Manager Client Tools 12 | grafana | 10.4.15-1.71.1 | SUSE-SU-2025:0622-1 |
| SUSE Enterprise Storage 7.1 | buildah | 1.35.4-150300.8.25.1 | SUSE-SU-2024:3120-1 |
| SUSE Enterprise Storage 7.1 | docker | 25.0.6_ce-150000.207.1 | SUSE-SU-2024:3120-1 |
| SUSE Enterprise Storage 7.1 | skopeo | 1.14.4-150300.11.11.1 | SUSE-SU-2024:1987-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apptainer | 1.3.6-2.1 | openSUSE-SU-2025:14618-1 |
| openSUSE Tumbleweed | buildah | 1.35.4-1.1 | openSUSE-SU-2024:13952-1 |
| openSUSE Tumbleweed | cmctl | 1.14.5-1.1 | openSUSE-SU-2024:13905-1 |
| openSUSE Tumbleweed | traefik | 3.5.1-1.1 | openSUSE-SU-2025:15529-1 |
| openSUSE Tumbleweed | traefik2 | 2.11.26-1.1 | openSUSE-SU-2025:15305-1 |
| openSUSE Tumbleweed | velociraptor | 0.7.0.4.git142.862ef23-1.1 | openSUSE-SU-2025:14663-1 |
| openSUSE Leap 15.6 | apptainer | 1.3.6-150600.4.3.1 | SUSE-SU-2025:0066-1 |
| openSUSE Leap 15.6 | buildah | 1.35.4-150500.3.10.1 | SUSE-SU-2024:3151-1 |
| openSUSE Leap 15.6 | docker | 25.0.6_ce-150000.207.1 | SUSE-SU-2024:3120-1 |
| openSUSE Leap 15.6 | grafana | 10.4.15-150200.3.64.1 | SUSE-SU-2025:0623-1 |
| openSUSE Leap 15.6 | skopeo | 1.14.4-150300.11.11.1 | SUSE-SU-2024:1987-1 |
| openSUSE Leap 15.5 | buildah | 1.35.4-150500.3.10.1 | SUSE-SU-2024:3151-1 |
| openSUSE Leap 15.5 | docker | 25.0.6_ce-150000.207.1 | SUSE-SU-2024:3120-1 |
| openSUSE Leap 15.5 | skopeo | 1.14.4-150300.11.11.1 | SUSE-SU-2024:1987-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.5 | docker | 25.0.6_ce-150000.207.1 | SUSE-SU-2024:3120-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | buildah | 1.35.4-r0 | — |
| Alpine v3.23 | buildah | 1.35.4-r0 | — |
| Alpine v3.22 | buildah | 1.35.4-r0 | — |
| Alpine v3.21 | buildah | 1.35.4-r0 | — |
| Alpine v3.20 | buildah | 1.35.4-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nerdctl | 1.7.6-1.amzn2023.0.1 | ALAS2023-2024-700 |
| Amazon Linux 2 | nerdctl | 1.7.6-1.amzn2.0.1 | ALAS2-2024-2618 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | buildah | 1.41.4-2 | — |
| Azure Linux 3 | cert-manager | 1.12.12-1 | — |
| Azure Linux 3 | containerd | 1.7.13-6 | — |
| Azure Linux 3 | containerized-data-importer | 1.57.0-9 | — |
| Azure Linux 3 | dcos-cli | 1.2.0-16 | — |
| Azure Linux 3 | influxdb | 2.7.3-9 | — |
| Azure Linux 3 | keda | 2.14.0-1 | — |
| Azure Linux 3 | kubernetes | 1.30.1-1 | — |
| Azure Linux 3 | moby-containerd-cc | 1.7.7-6 | — |
| Azure Linux 3 | packer | 1.9.5-6 | — |
| Azure Linux 3 | podman | 5.6.1-2 | — |
| Azure Linux 3 | skopeo | 1.14.4-1 | — |
| Azure Linux 3 | telegraf | 1.31.0-1 | — |
| Azure Linux 2 (CBL-Mariner) | cert-manager | 1.11.2-14 | — |
| Azure Linux 2 (CBL-Mariner) | containerized-data-importer | 1.55.0-20 | — |
| Azure Linux 2 (CBL-Mariner) | cri-o | 1.21.7-2 | — |
| Azure Linux 2 (CBL-Mariner) | dcos-cli | 1.2.0-19 | — |
| Azure Linux 2 (CBL-Mariner) | influxdb | 2.6.1-20 | — |
| Azure Linux 2 (CBL-Mariner) | keda | 2.4.0-26 | — |
| Azure Linux 2 (CBL-Mariner) | kube-vip-cloud-provider | 0.0.2-19 | — |
| Azure Linux 2 (CBL-Mariner) | kubernetes | 1.28.4-12 | — |
| Azure Linux 2 (CBL-Mariner) | moby-containerd | 1.6.26-9 | — |
| Azure Linux 2 (CBL-Mariner) | moby-containerd-cc | 1.7.7-9 | — |
| Azure Linux 2 (CBL-Mariner) | packer | 1.9.5-8 | — |
| Azure Linux 2 (CBL-Mariner) | podman +1 | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | rook | 1.6.2-23 | — |
| Azure Linux 2 (CBL-Mariner) | skopeo | 1.14.2-9 | — |
| Azure Linux 2 (CBL-Mariner) | telegraf | 1.29.4-8 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | buildah +1 | 2:1.33.7-2.0.1.el9_4 | ELSA-2024-3827 |
| Oracle Linux 9 | podman +4 | 4:4.9.4-4.0.1.el9_4 | ELSA-2024-3826 |
| Oracle Linux 9 | skopeo +1 | 2:1.14.3-2.el9_4 | ELSA-2024-2549 |
| Oracle Linux 8 | aardvark-dns | 2:1.10.0-1.module+el8.10.0+90298+77a9814d | ELSA-2024-3968, ELSA-2024-3254 |
| Oracle Linux 8 | buildah +1 | 2:1.33.7-1.module+el8.10.0+90337+0d7b6e74 | ELSA-2024-3968, ELSA-2024-3254 |
| Oracle Linux 8 | cockpit-podman | 84.1-1.module+el8.10.0+90298+77a9814d | ELSA-2024-3968, ELSA-2024-3254 |
| Oracle Linux 8 | conmon | 3:2.1.10-1.module+el8.10.0+90298+77a9814d | ELSA-2024-3968, ELSA-2024-3254 |
| Oracle Linux 8 | container-selinux | 2:2.229.0-2.module+el8.10.0+90298+77a9814d | ELSA-2024-3968, ELSA-2024-3254 |
| Oracle Linux 8 | containernetworking-plugins | 1:1.4.0-2.module+el8.10.0+90298+77a9814d | ELSA-2024-3968, ELSA-2024-3254 |
| Oracle Linux 8 | containers-common | 2:1-81.0.1.module+el8.10.0+90298+77a9814d | ELSA-2024-3968, ELSA-2024-3254 |
| Oracle Linux 8 | crit +4 | 3.18-5.module+el8.10.0+90337+0d7b6e74 | ELSA-2024-3968, ELSA-2024-3254 |
| Oracle Linux 8 | crun | 1.14.3-2.module+el8.10.0+90298+77a9814d | ELSA-2024-3968, ELSA-2024-3254 |
| Oracle Linux 8 | fuse-overlayfs | 1.13-1.module+el8.10.0+90298+77a9814d | ELSA-2024-3968, ELSA-2024-3254 |
| Oracle Linux 8 | libslirp +1 | 4.4.0-2.module+el8.10.0+90337+0d7b6e74 | ELSA-2024-3968, ELSA-2024-3254 |
| Oracle Linux 8 | netavark | 2:1.10.3-1.module+el8.10.0+90298+77a9814d | ELSA-2024-3968, ELSA-2024-3254 |
| Oracle Linux 8 | oci-seccomp-bpf-hook | 1.2.10-1.module+el8.10.0+90298+77a9814d | ELSA-2024-3968, ELSA-2024-3254 |
| Oracle Linux 8 | podman +6 | 4:4.9.4-1.module+el8.10.0+90337+0d7b6e74 | ELSA-2024-3968, ELSA-2024-3254 |
| Oracle Linux 8 | python3-podman | 4.9.0-1.module+el8.10.0+90298+77a9814d | ELSA-2024-3968, ELSA-2024-3254 |
| Oracle Linux 8 | runc | 1:1.1.12-1.module+el8.10.0+90298+77a9814d | ELSA-2024-3968, ELSA-2024-3254 |
| Oracle Linux 8 | skopeo +1 | 2:1.14.3-2.module+el8.10.0+90337+0d7b6e74 | ELSA-2024-3968, ELSA-2024-3254 |
| Oracle Linux 8 | slirp4netns | 1.2.3-1.module+el8.10.0+90298+77a9814d | ELSA-2024-3968, ELSA-2024-3254 |
| Oracle Linux 8 | udica | 0.2.6-21.module+el8.10.0+90337+0d7b6e74 | ELSA-2024-3968, ELSA-2024-3254 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | aactl | 0.4.12-r7 | — |
| Wolfi rolling | apko | 0.14.0-r3 | — |
| Wolfi rolling | argo-workflows | 3.5.5-r2 | — |
| Wolfi rolling | bank-vaults | 1.32.0-r2 | — |
| Wolfi rolling | caddy-man | 2.8.4-r0 | — |
| Wolfi rolling | cloudflared | 2024.1.0-r4 | — |
| Wolfi rolling | cosign | 2.2.3-r2 | — |
| Wolfi rolling | dex | 2.38.0-r1 | — |
| Wolfi rolling | dgraph | 24.0.0-r0 | — |
| Wolfi rolling | falcoctl | 0.7.3-r2 | — |
| Wolfi rolling | flux-source-controller +1 | 1.2.4-r4 | — |
| Wolfi rolling | flyte +2 | No fix yet | — |
| Wolfi rolling | frp | 0.54.0-r2 | — |
| Wolfi rolling | fulcio | 1.4.4-r2 | — |
| Wolfi rolling | gitsign +2 | 0.8.1-r3 | — |
| Wolfi rolling | gomplate | 4.0.0-r0 | — |
| Wolfi rolling | goreleaser | 1.25.0-r0 | — |
| Wolfi rolling | grpc-health-probe +1 | 0.4.24-r3 | — |
| Wolfi rolling | guac +4 | 0.5.1-r1 | — |
| Wolfi rolling | k3s-multicall-1.32 | 1.32.9.1-r2 | — |
| Wolfi rolling | kargo +1 | 0.4.3-r2 | — |
| Wolfi rolling | ko | 0.15.2-r3 | — |
| Wolfi rolling | kots | 1.128.3-r0 | — |
| Wolfi rolling | kube-rbac-proxy | 0.18.1-r0 | — |
| Wolfi rolling | kubernetes-dashboard | 7.5.0-r0 | — |
| Wolfi rolling | kubescape | 3.0.43-r0 | — |
| Wolfi rolling | melange | 0.6.9-r2 | — |
| Wolfi rolling | minio +1 | 0.20240606.093642-r0 | — |
| Wolfi rolling | nerdctl | 1.7.5-r0 | — |
| Wolfi rolling | oauth2-proxy +1 | 7.6.0-r2 | — |
| Wolfi rolling | policy-controller +1 | 0.8.4-r3 | — |
| Wolfi rolling | rabbitmq-messaging-topology-operator +2 | 1.13.0-r2 | — |
| Wolfi rolling | rekor +3 | 1.3.5-r2 | — |
| Wolfi rolling | rook +1 | 1.13.6-r1 | — |
| Wolfi rolling | sigstore-scaffolding +13 | 0.6.16-r2 | — |
| Wolfi rolling | skaffold | 2.10.1-r2 | — |
| Wolfi rolling | skopeo | 1.14.2-r3 | — |
| Wolfi rolling | slsa-verifier | 2.5.1-r4 | — |
| Wolfi rolling | sops | 3.11.0-r1 | — |
| Wolfi rolling | spire-agent +2 | 1.9.1-r1 | — |
| Wolfi rolling | step | 0.25.2-r2 | — |
| Wolfi rolling | step-ca | 0.25.2-r4 | — |
| Wolfi rolling | tekton-chains | 0.20.0-r3 | — |
| Wolfi rolling | temporal +1 | 1.1.2-r0 | — |
| Wolfi rolling | temporal-ui-server +1 | 2.32.0-r0 | — |
| Wolfi rolling | terragrunt +1 | 0.55.14-r1 | — |
| Wolfi rolling | timestamp-authority +4 | 1.2.2-r2 | — |
| Wolfi rolling | tkn | 0.35.1-r2 | — |
| Wolfi rolling | vexctl | 0.2.6-r7 | — |
| Wolfi rolling | weaviate | 1.24.1-r2 | — |
| Wolfi rolling | wolfictl | 0.15.3-r3 | — |
| Wolfi rolling | zarf | 0.32.4-r2 | — |
| Wolfi rolling | zot | 2.1.10-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/go-jose/go-jose/v3 | < 3.0.3 | 3.0.3 | GHSA-c5q2-7r4c-mv6g |
| Go | github.com/go-jose/go-jose/v4 | < 4.0.1 | 4.0.1 | GHSA-c5q2-7r4c-mv6g |
| Go | gopkg.in/go-jose/go-jose.v2 | < 2.6.3 | 2.6.3 | GHSA-c5q2-7r4c-mv6g |
| Go | gopkg.in/square/go-jose.v2 | <= 2.6.0 | — | GHSA-c5q2-7r4c-mv6g |
| Go | gopkg.in/square/go-jose.v2 | all versions | — | GO-2024-2631 |
Advisories 50
- RHSA-2024:3351 Red Hat Security Advisory: OpenShift Container Platform 4.12.58 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- ALSA-2024:2549 Moderate: skopeo security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:3826 Moderate: podman security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:3827 Moderate: buildah security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:3254 Important: container-tools:rhel8 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:3968 Moderate: container-tools:rhel8 bug fix and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:3254 Red Hat Security Advisory: container-tools:rhel8 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:2549 Red Hat Security Advisory: skopeo security and bug fix update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:1574 Red Hat Security Advisory: OpenShift Container Platform 4.12.54 packages and security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:1563 Red Hat Security Advisory: OpenShift Container Platform 4.15.6 packages and security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:1456 Red Hat Security Advisory: OpenShift Container Platform 4.13.38 packages and security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:3968 Red Hat Security Advisory: container-tools:rhel8 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:3827 Red Hat Security Advisory: buildah security and bug fix update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:3826 Red Hat Security Advisory: podman security and bug fix update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:2877 Red Hat Security Advisory: OpenShift Container Platform 4.13.42 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:2776 Red Hat Security Advisory: OpenShift Container Platform 4.15.13 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:2784 Red Hat Security Advisory: OpenShift Container Platform 4.12.57 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:2672 Red Hat Security Advisory: OpenShift Container Platform 4.14.24 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:2669 Red Hat Security Advisory: OpenShift Container Platform 4.15.12 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:2054 Red Hat Security Advisory: OpenShift Container Platform 4.14.23 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:2071 Red Hat Security Advisory: OpenShift Container Platform 4.15.11 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:2049 Red Hat Security Advisory: OpenShift Container Platform 4.13.41 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:1567 Red Hat Security Advisory: OpenShift Container Platform 4.14.19 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHEA-2024:4022 Red Hat Enhancement Advisory: Red Hat OpenShift Pipelines Client tkn for 1.15.0 release Red Hat Security Advisories (RHSA) · Oct 16, 2026
- openSUSE-SU-2025:15529-1 traefik-3.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15305-1 traefik2-2.11.26-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20019-1 Security update for skopeo SUSE / openSUSE Security Updates · Mar 23, 2026
- RLSA-2024:3968 Moderate: container-tools:rhel8 bug fix and enhancement update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2024:3826 Moderate: podman security and bug fix update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2024:2549 Moderate: skopeo security and bug fix update Rocky Linux Security Advisories · Feb 4, 2026
- RLSA-2024:3827 Moderate: buildah security and bug fix update Rocky Linux Security Advisories · Feb 4, 2026
- openSUSE-SU-2025:14618-1 apptainer-1.3.6-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13905-1 cmctl-1.14.5-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0624-1 Security update for grafana SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13952-1 buildah-1.35.4-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14663-1 velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0622-1 Security update for grafana SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3186-1 Security update for buildah SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:1987-2 Security update for skopeo SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2754-1 Security update for skopeo SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0623-1 Security update for grafana SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:1987-1 Security update for skopeo SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3120-1 Security update for buildah, docker SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0066-1 Security update for apptainer SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1474 Red Hat OpenShift Container Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 26, 2025
- SUSE-SU-2024:3151-1 Security update for buildah SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2024-0947 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 17, 2024
- WID-SEC-2024-2035 Red Hat OpenShift: Mehrere Schwachstellen ermöglichen Manipulation von Dateien und Denial of Service BSI CERT-Bund (WID) · Nov 12, 2024
- ALAS2-2024-2618 Moderate: nerdctl security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 28, 2024
- ALAS2023-2024-700 Moderate: nerdctl security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 6, 2024
References
- https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g
- https://github.com/go-jose/go-jose/commit/0dd4dd541c665fb292d664f77604ba694726f298
- https://github.com/go-jose/go-jose/commit/add6a284ea0f844fd6628cba637be5451fe4b28a
- https://github.com/go-jose/go-jose/commit/f4c051a0653d78199a053892f7619ebf96339502
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJDO5VSIAOGT2WP63AXAAWNRSVJCNCRH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KXKGNCRU7OTM5AHC7YIYBNOWI742PRMY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJO2U5ACZVACNQXJ5EBRFLFW6DP5BROY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UG5FSEYJ3GP27FZXC5YAAMMEC5XWKJHG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IJ6LAJJ2FTA2JVVOACCV5RZTOIZLXUNJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JNPMXL36YGS3GQEVI3Q5HKHJ7YAAQXL5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MSOMHDKRPU3A2JEMRODT2IREDFBLVPGS/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GD2GSBQTBLYADASUBHHZV2CZPTSLIPQJ/