CVE-2024-28180 Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)
An attacker can cause excessive memory and CPU consumption via compressed JWE data, leading to denial of service in applications using the Go JOSE library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-28180?
CVE-2024-28180 is a medium-severity denial of service vulnerability in Fedoraproject Fedora, published on 9 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.
Weakness: CWE-409
Which versions are affected by CVE-2024-28180?
12 open source packages ship an affected version, including github.com/go-jose/go-jose/v3, github.com/go-jose/go-jose/v4 and gopkg.in/go-jose/go-jose.v2. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/go-jose/go-jose/v3 Go | All versions | 3.0.3 |
github.com/go-jose/go-jose/v3 Go | All versions | 3.0.3 |
github.com/go-jose/go-jose/v3 Go | All versions | 3.0.3 |
github.com/go-jose/go-jose/v4 Go | All versions | 4.0.1 |
github.com/go-jose/go-jose/v4 Go | All versions | 4.0.1 |
github.com/go-jose/go-jose/v4 Go | All versions | 4.0.1 |
6 more packages
gopkg.in/go-jose/go-jose.v2 Go | All versions | 2.6.3 |
gopkg.in/go-jose/go-jose.v2 Go | All versions | 2.6.3 |
gopkg.in/go-jose/go-jose.v2 Go | All versions | 2.6.3 |
gopkg.in/square/go-jose.v2 Go | All versions | None |
gopkg.in/square/go-jose.v2 Go | All versions to 2.6.0 | None |
gopkg.in/square/go-jose.v2 Go | All versions to 2.6.0 | None |
Linux distribution packages (28)
cri-o Red Hat:openshift:4.12::el8 | All versions | 0:1.25.5-19.2.rhaos4.12.gitba93e0a.el8 |
cri-o-debuginfo Red Hat:openshift:4.12::el8 | All versions | 0:1.25.5-19.2.rhaos4.12.gitba93e0a.el8 |
cri-o-debugsource Red Hat:openshift:4.12::el8 | All versions | 0:1.25.5-19.2.rhaos4.12.gitba93e0a.el8 |
podman Red Hat:openshift:4.12::el8 | All versions | 3:4.4.1-4.2.rhaos4.12.el8 |
podman-catatonit Red Hat:openshift:4.12::el8 | All versions | 3:4.4.1-4.2.rhaos4.12.el8 |
podman-catatonit-debuginfo Red Hat:openshift:4.12::el8 | All versions | 3:4.4.1-4.2.rhaos4.12.el8 |
podman-debuginfo Red Hat:openshift:4.12::el8 | All versions | 3:4.4.1-4.2.rhaos4.12.el8 |
podman-debugsource Red Hat:openshift:4.12::el8 | All versions | 3:4.4.1-4.2.rhaos4.12.el8 |
podman-docker Red Hat:openshift:4.12::el8 | All versions | 3:4.4.1-4.2.rhaos4.12.el8 |
podman-gvproxy Red Hat:openshift:4.12::el8 | All versions | 3:4.4.1-4.2.rhaos4.12.el8 |
podman-gvproxy-debuginfo Red Hat:openshift:4.12::el8 | All versions | 3:4.4.1-4.2.rhaos4.12.el8 |
podman-plugins Red Hat:openshift:4.12::el8 | All versions | 3:4.4.1-4.2.rhaos4.12.el8 |
podman-plugins-debuginfo Red Hat:openshift:4.12::el8 | All versions | 3:4.4.1-4.2.rhaos4.12.el8 |
podman-remote Red Hat:openshift:4.12::el8 | All versions | 3:4.4.1-4.2.rhaos4.12.el8 |
podman-remote-debuginfo Red Hat:openshift:4.12::el8 | All versions | 3:4.4.1-4.2.rhaos4.12.el8 |
podman-tests Red Hat:openshift:4.12::el8 | All versions | 3:4.4.1-4.2.rhaos4.12.el8 |
openshift-clients Red Hat:openshift:4.15::el8 | All versions | 0:4.15.0-202405021207.p0.g7693229.assembly.stream.el8 |
openshift-clients-redistributable Red Hat:openshift:4.15::el8 | All versions | 0:4.15.0-202405021207.p0.g7693229.assembly.stream.el8 |
skopeo Red Hat:openshift:4.15::el8 | All versions | 2:1.11.3-0.1.rhaos4.15.el8 |
skopeo-debuginfo Red Hat:openshift:4.15::el8 | All versions | 2:1.11.3-0.1.rhaos4.15.el8 |
skopeo-debugsource Red Hat:openshift:4.15::el8 | All versions | 2:1.11.3-0.1.rhaos4.15.el8 |
skopeo-tests Red Hat:openshift:4.15::el8 | All versions | 2:1.11.3-0.1.rhaos4.15.el8 |
openshift-clients Red Hat:openshift:4.15::el9 | All versions | 0:4.15.0-202405021207.p0.g7693229.assembly.stream.el9 |
openshift-clients-redistributable Red Hat:openshift:4.15::el9 | All versions | 0:4.15.0-202405021207.p0.g7693229.assembly.stream.el9 |
skopeo Red Hat:openshift:4.15::el9 | All versions | 2:1.11.3-0.1.rhaos4.15.el9 |
skopeo-debuginfo Red Hat:openshift:4.15::el9 | All versions | 2:1.11.3-0.1.rhaos4.15.el9 |
skopeo-debugsource Red Hat:openshift:4.15::el9 | All versions | 2:1.11.3-0.1.rhaos4.15.el9 |
skopeo-tests Red Hat:openshift:4.15::el9 | All versions | 2:1.11.3-0.1.rhaos4.15.el9 |
Products include Fedoraproject Fedora, Go-Jose Project Go-Jose.
How do I fix CVE-2024-28180?
Upgrade github.com/go-jose/go-jose/v3 to 3.0.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-28180 being exploited?
There is no known exploitation of CVE-2024-28180 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as AZL-35837, AZL-35839, AZL-35840, AZL-35842, AZL-35843, AZL-35844 and 53 more.