CVE-2024-28176

jose project jose, fedoraproject fedora

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2024-28176

Katalog CVE

CVSS 5.9 · Medium EPSS 2,1%

Kerentanan Uncontrolled Resource Consumption pada jose project jose, fedoraproject fedora. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.

Rincian

Terbit di NVD
9 Maret 2024
Terakhir diubah
17 Juni 2026
Status NVD
Analyzed
CVSS 3.1
5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-400: Uncontrolled Resource Consumption
EPSS (30 hari)
2,1% peluang dieksploitasi; lebih tinggi dari 81,2% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
jose project jose Semua versi sebelum 2.0.7
jose project jose Versi 3.0.0 hingga sebelum 4.15.5
fedoraproject fedora Versi 38 hingga 40

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.