CVE-2024-28176

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-28176

4.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

j

ose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.

References
Link Resource
https://github.com/panva/jose/commit/02a65794f7873cdaf12e81e80ad076fcdc4a9314 Patch
https://github.com/panva/jose/commit/1b91d88d2f8233f3477a5f4579aa5f8057b2ee8b Patch
https://github.com/panva/jose/security/advisories/GHSA-hhhv-q57g-882q Vendor Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/KXKGNCRU7OTM5AHC7YIYBNOWI742PRMY/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/UG5FSEYJ3GP27FZXC5YAAMMEC5XWKJHG/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/UJO2U5ACZVACNQXJ5EBRFLFW6DP5BROY/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/XJDO5VSIAOGT2WP63AXAAWNRSVJCNCRH/ Mailing List Third Party Advisory
https://github.com/panva/jose/commit/02a65794f7873cdaf12e81e80ad076fcdc4a9314 Patch
https://github.com/panva/jose/commit/1b91d88d2f8233f3477a5f4579aa5f8057b2ee8b Patch
https://github.com/panva/jose/security/advisories/GHSA-hhhv-q57g-882q Vendor Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/KXKGNCRU7OTM5AHC7YIYBNOWI742PRMY/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/UG5FSEYJ3GP27FZXC5YAAMMEC5XWKJHG/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/UJO2U5ACZVACNQXJ5EBRFLFW6DP5BROY/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/XJDO5VSIAOGT2WP63AXAAWNRSVJCNCRH/ Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:jose_project:jose:*:*:*:*:*:node.js:*:*
cpe:2.3:a:jose_project:jose:*:*:*:*:*:node.js:*:*

Configuration 2 (hide)

cpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
History

05 Dec 2025, 16:48

Type Values Removed Values Added
First Time Jose Project jose
Fedoraproject
Jose Project
Fedoraproject fedora
References () https://github.com/panva/jose/commit/02a65794f7873cdaf12e81e80ad076fcdc4a9314 - () https://github.com/panva/jose/commit/02a65794f7873cdaf12e81e80ad076fcdc4a9314 - Patch
References () https://github.com/panva/jose/commit/1b91d88d2f8233f3477a5f4579aa5f8057b2ee8b - () https://github.com/panva/jose/commit/1b91d88d2f8233f3477a5f4579aa5f8057b2ee8b - Patch
References () https://github.com/panva/jose/security/advisories/GHSA-hhhv-q57g-882q - () https://github.com/panva/jose/security/advisories/GHSA-hhhv-q57g-882q - Vendor Advisory
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG/ - () https://lists.fedoraproject.org/archives/list/[email protected]/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG/ - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/KXKGNCRU7OTM5AHC7YIYBNOWI742PRMY/ - () https://lists.fedoraproject.org/archives/list/[email protected]/message/KXKGNCRU7OTM5AHC7YIYBNOWI742PRMY/ - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/UG5FSEYJ3GP27FZXC5YAAMMEC5XWKJHG/ - () https://lists.fedoraproject.org/archives/list/[email protected]/message/UG5FSEYJ3GP27FZXC5YAAMMEC5XWKJHG/ - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/UJO2U5ACZVACNQXJ5EBRFLFW6DP5BROY/ - () https://lists.fedoraproject.org/archives/list/[email protected]/message/UJO2U5ACZVACNQXJ5EBRFLFW6DP5BROY/ - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/XJDO5VSIAOGT2WP63AXAAWNRSVJCNCRH/ - () https://lists.fedoraproject.org/archives/list/[email protected]/message/XJDO5VSIAOGT2WP63AXAAWNRSVJCNCRH/ - Mailing List, Third Party Advisory
CPE cpe:2.3:a:jose_project:jose:*:*:*:*:*:node.js:*:*
cpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*

21 Nov 2024, 09:05

Type Values Removed Values Added
References () https://github.com/panva/jose/commit/02a65794f7873cdaf12e81e80ad076fcdc4a9314 - () https://github.com/panva/jose/commit/02a65794f7873cdaf12e81e80ad076fcdc4a9314 -
References () https://github.com/panva/jose/commit/1b91d88d2f8233f3477a5f4579aa5f8057b2ee8b - () https://github.com/panva/jose/commit/1b91d88d2f8233f3477a5f4579aa5f8057b2ee8b -
References () https://github.com/panva/jose/security/advisories/GHSA-hhhv-q57g-882q - () https://github.com/panva/jose/security/advisories/GHSA-hhhv-q57g-882q -
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG/ - () https://lists.fedoraproject.org/archives/list/[email protected]/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG/ -
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/KXKGNCRU7OTM5AHC7YIYBNOWI742PRMY/ - () https://lists.fedoraproject.org/archives/list/[email protected]/message/KXKGNCRU7OTM5AHC7YIYBNOWI742PRMY/ -
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/UG5FSEYJ3GP27FZXC5YAAMMEC5XWKJHG/ - () https://lists.fedoraproject.org/archives/list/[email protected]/message/UG5FSEYJ3GP27FZXC5YAAMMEC5XWKJHG/ -
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/UJO2U5ACZVACNQXJ5EBRFLFW6DP5BROY/ - () https://lists.fedoraproject.org/archives/list/[email protected]/message/UJO2U5ACZVACNQXJ5EBRFLFW6DP5BROY/ -
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/XJDO5VSIAOGT2WP63AXAAWNRSVJCNCRH/ - () https://lists.fedoraproject.org/archives/list/[email protected]/message/XJDO5VSIAOGT2WP63AXAAWNRSVJCNCRH/ -
Information

Published : 2024-03-09 01:15

Updated : 2025-12-05 16:48

NVD link : CVE-2024-28176

Mitre link : CVE-2024-28176

CVE.ORG link : CVE-2024-28176

JSON object : View

Products Affected

fedoraproject

jose_project

CWE
CWE-400

Uncontrolled Resource Consumption