Closed renovate[bot] closed 4 weeks ago
github-actions[bot]
commented
1 month ago This PR has been marked as stale after 7 or more days of inactivity. Please have a maintainer add the on hold label if this PR should remain open. If there is no further activity or the on hold label is not added, this PR will be closed in 3 days.
renovate[bot]
commented
4 weeks ago Because you closed this PR without merging, Renovate will ignore this update (v3.0.3). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.
If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.
This PR contains the following updates:
v3.0.0->v3.0.3GitHub Vulnerability Alerts
GHSA-2c7c-3mj9-8fqh
The go-jose package is subject to a "billion hashes attack" causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-service.
CVE-2024-28180
Impact
An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). Thanks to Enze Wang@Alioth and Jianjun Chen@Zhongguancun Lab (@zer0yu and @chenjj) for reporting.
Patches
The problem is fixed in the following packages and versions:
The problem will not be fixed in the following package because the package is archived:
Release Notes
go-jose/go-jose (github.com/go-jose/go-jose/v3)
### [`v3.0.3`](https://togithub.com/go-jose/go-jose/releases/tag/v3.0.3): Version 3.0.3 [Compare Source](https://togithub.com/go-jose/go-jose/compare/v3.0.2...v3.0.3) #### Fixed - Limit decompression output size to prevent a DoS. Backport from v4.0.1. ### [`v3.0.2`](https://togithub.com/go-jose/go-jose/blob/HEAD/CHANGELOG.md#v302) [Compare Source](https://togithub.com/go-jose/go-jose/compare/v3.0.1...v3.0.2) #### Fixed - DecryptMulti: handle decompression error ([#19](https://togithub.com/go-jose/go-jose/issues/19)) #### Changed - jwe/CompactSerialize: improve performance ([#67](https://togithub.com/go-jose/go-jose/issues/67)) - Increase the default number of PBKDF2 iterations to 600k ([#48](https://togithub.com/go-jose/go-jose/issues/48)) - Return the proper algorithm for ECDSA keys ([#45](https://togithub.com/go-jose/go-jose/issues/45)) #### Added - Add Thumbprint support for opaque signers ([#38](https://togithub.com/go-jose/go-jose/issues/38)) ### [`v3.0.1`](https://togithub.com/go-jose/go-jose/blob/HEAD/CHANGELOG.md#v301) [Compare Source](https://togithub.com/go-jose/go-jose/compare/v3.0.0...v3.0.1) #### Fixed - Security issue: an attacker specifying a large "p2c" value can cause JSONWebEncryption.Decrypt and JSONWebEncryption.DecryptMulti to consume large amounts of CPU, causing a DoS. Thanks to Matt Schwager ([@mschwager](https://togithub.com/mschwager)) for the disclosure and to Tom Tervoort for originally publishing the category of attack. https://i.blackhat.com/BH-US-23/Presentations/US-23-Tervoort-Three-New-Attacks-Against-JSON-Web-Tokens.pdfConfiguration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.