CVE-2024-28180: Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)
Impact An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). Thanks to Enze Wang@Alioth and Jianjun Chen@Zhongguancun Lab (@zer0yu and @chenjj) for reporting.
Patches The problem is fixed in the following packages and versions: - github.com/go-jose/go-jose/v4 version 4.0.1 - github.com/go-jose/go-jose/v3 version 3.0.3 - gopkg.in/go-jose/go-jose.v2 version 2.6.3
The problem will not be fixed in the following package because the package is archived: - gopkg.in/square/go-jose.v2
Other sources
Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)
— Microsoft
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/gopkg.in/go-jose/go-jose.v2to a version that resolves this vulnerability.Fixed in 2.6.3 - Upgrade
Upgrade
go/github.com/go-jose/go-jose/v3to a version that resolves this vulnerability.Fixed in 3.0.3 - Upgrade
Upgrade
go/github.com/go-jose/go-jose/v4to a version that resolves this vulnerability.Fixed in 4.0.1 - Upgrade
Upgrade
redhat/go-joseto a version that resolves this vulnerability.Fixed in 4.0.1 - Upgrade
Upgrade
redhat/go-joseto a version that resolves this vulnerability.Fixed in 3.0.3 - Upgrade
Upgrade
redhat/go-joseto a version that resolves this vulnerability.Fixed in 2.6.3 - Upgrade
Upgrade
github.com/go-jose/go-jose/v3to a version that resolves this vulnerability.Fixed in 3.0.3Patch GHSA-c5q2-7r4c-mv6g - Upgrade
Upgrade
github.com/go-jose/go-jose/v4to a version that resolves this vulnerability.Fixed in 4.0.1Patch GHSA-c5q2-7r4c-mv6g - Upgrade
Upgrade
gopkg.in/go-jose/go-jose.v2to a version that resolves this vulnerability.Fixed in 2.6.3Patch GHSA-c5q2-7r4c-mv6g
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28180?
CVE-2024-28180 has a medium severity rating due to the potential for resource exhaustion.
How do I fix CVE-2024-28180?
To mitigate CVE-2024-28180, update to go-jose versions 2.6.3, 3.0.3, or 4.0.1.
What types of attacks are associated with CVE-2024-28180?
CVE-2024-28180 can be exploited through specially crafted JSON Web Encryption (JWE) tokens to cause excessive resource consumption.
Which software versions are affected by CVE-2024-28180?
CVE-2024-28180 affects go-jose versions prior to 2.6.3, 3.0.3, and 4.0.1.
What are the new limitations introduced by CVE-2024-28180?
CVE-2024-28180 adds limitations to JWE decompression, capping it at 250kB or 10 times the compressed size.