CVE-2024-28176

published 2024-03-09

CVE-2024-28176: jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption…

Priority P4 31 medium 5.9 CVSS 3.1

AV N AC H PR N UI N S U C N I N A H

jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has
been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
fedoraproject	fedora	38 – 40	—
jose-node-cjs-runtime_project	jose-node-cjs-runtime	>= 0 < 4.15.5	4.15.5
jose_project	jose	< 2.0.7	2.0.7
jose_project	jose	>= 0 < 2.0.7	2.0.7
jose_project	jose	>= 3.0.0 < 4.15.5	4.15.5
jose_project	jose	>= 3.0.0 < 4.15.5	4.15.5
panva	jose	< 2.0.7	2.0.7
panva	jose	—	—

CVSS provenance

nvd v3.1 5.9 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

osv 5.9 MEDIUM

vendor_redhat 4.9 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-400