An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). Thanks to Enze Wang@Alioth and Jianjun Chen@Zhongguancun Lab (@zer0yu and @chenjj) for reporting.
Patches
The problem is fixed in v4.0.1, v3.0.3, v2.6.3
Release Notes
go-jose/go-jose (gopkg.in/go-jose/go-jose.v2)
### [`v2.6.3`](https://togithub.com/go-jose/go-jose/releases/tag/v2.6.3): Version 2.6.3
[Compare Source](https://togithub.com/go-jose/go-jose/compare/v2.6.2...v2.6.3)
#### Fixed
- Limit decompression output size to prevent a DoS. Backport from v4.0.1.
### [`v2.6.2`](https://togithub.com/go-jose/go-jose/compare/v2.6.1...v2.6.2)
[Compare Source](https://togithub.com/go-jose/go-jose/compare/v2.6.1...v2.6.2)
Configuration
📅 Schedule: Branch creation - "" in timezone UTC, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
â™» Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
[ ] If you want to rebase/retry this PR, check this box
This PR has been generated by Mend Renovate. View repository job log here.
This PR contains the following updates:
v2.6.1->v2.6.3GitHub Vulnerability Alerts
CVE-2024-28180
Impact
An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). Thanks to Enze Wang@Alioth and Jianjun Chen@Zhongguancun Lab (@zer0yu and @chenjj) for reporting.
Patches
The problem is fixed in v4.0.1, v3.0.3, v2.6.3
Release Notes
go-jose/go-jose (gopkg.in/go-jose/go-jose.v2)
### [`v2.6.3`](https://togithub.com/go-jose/go-jose/releases/tag/v2.6.3): Version 2.6.3 [Compare Source](https://togithub.com/go-jose/go-jose/compare/v2.6.2...v2.6.3) #### Fixed - Limit decompression output size to prevent a DoS. Backport from v4.0.1. ### [`v2.6.2`](https://togithub.com/go-jose/go-jose/compare/v2.6.1...v2.6.2) [Compare Source](https://togithub.com/go-jose/go-jose/compare/v2.6.1...v2.6.2)Configuration
📅 Schedule: Branch creation - "" in timezone UTC, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
â™» Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.