Resource exhaustion in Jose Project
CVE-2024-28176
jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.021 (79.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Jose_project Jose
- Panva Jose — versions >= 3.0.0, <= 4.15.4, < 2.0.7
- Fedoraproject Fedora
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Mailing List, Third Party Advisory)
- security-advisories@github.com (Mailing List, Third Party Advisory)
- security-advisories@github.com (Mailing List, Third Party Advisory)
- security-advisories@github.com (Mailing List, Third Party Advisory)
- security-advisories@github.com (Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2024-28176?
- CVE-2024-28176 is a medium-severity vulnerability in Jose Project, classified under Uncontrolled Resource Consumption. CVSS score: 4.9/10. Published 2024-03-09.
- How severe is CVE-2024-28176?
- Medium severity. CVSS v3 base score is 4.9 out of 10.
- Is CVE-2024-28176 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.