CVE-2024-28176 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2024-28176 Interim 1 8 2025-10-05T00:17:32Z current 2024-06-15T23:12:24Z 2025-10-05T00:17:32Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2024-28176 jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/suse-liberty-linux-updates/2024-November/000564.html E-Mail link for RHSA-2024:9181 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Liberty Linux 8 SUSE Liberty Linux 9 aardvark-dns-1.10.0-1.module+el8.10.0+21962+8143777b buildah-1.33.7-2.el9_4 buildah-1.33.7-2.module+el8.10.0+21962+8143777b buildah-tests-1.33.7-2.el9_4 buildah-tests-1.33.7-2.module+el8.10.0+21962+8143777b cockpit-podman-84.1-1.module+el8.10.0+21962+8143777b conmon-2.1.10-1.module+el8.10.0+21962+8143777b container-selinux-2.229.0-2.module+el8.10.0+21962+8143777b containernetworking-plugins-1.4.0-2.module+el8.10.0+21962+8143777b containers-common-1-81.module+el8.10.0+21962+8143777b crit-3.18-5.module+el8.10.0+21962+8143777b criu-3.18-5.module+el8.10.0+21962+8143777b criu-devel-3.18-5.module+el8.10.0+21962+8143777b criu-libs-3.18-5.module+el8.10.0+21962+8143777b crun-1.14.3-2.module+el8.10.0+21962+8143777b fuse-overlayfs-1.13-1.module+el8.10.0+21962+8143777b jose-10-2.el8_10.3 jose-14-1.el9 libjose-10-2.el8_10.3 libjose-14-1.el9 libjose-devel-10-2.el8_10.3 libjose-devel-14-1.el9 libslirp-4.4.0-2.module+el8.10.0+21962+8143777b libslirp-devel-4.4.0-2.module+el8.10.0+21962+8143777b netavark-1.10.3-1.module+el8.10.0+21962+8143777b oci-seccomp-bpf-hook-1.2.10-1.module+el8.10.0+21962+8143777b podman-4.9.4-3.module+el8.10.0+21974+acd2159c podman-4.9.4-4.el9_4 podman-catatonit-4.9.4-3.module+el8.10.0+21974+acd2159c podman-docker-4.9.4-3.module+el8.10.0+21974+acd2159c podman-docker-4.9.4-4.el9_4 podman-gvproxy-4.9.4-3.module+el8.10.0+21974+acd2159c podman-plugins-4.9.4-3.module+el8.10.0+21974+acd2159c podman-plugins-4.9.4-4.el9_4 podman-remote-4.9.4-3.module+el8.10.0+21974+acd2159c podman-remote-4.9.4-4.el9_4 podman-tests-4.9.4-3.module+el8.10.0+21974+acd2159c podman-tests-4.9.4-4.el9_4 python3-criu-3.18-5.module+el8.10.0+21962+8143777b python3-podman-4.9.0-1.module+el8.10.0+21962+8143777b runc-1.1.12-1.module+el8.10.0+21974+acd2159c skopeo-1.14.3-2.module+el8.10.0+21962+8143777b skopeo-tests-1.14.3-2.module+el8.10.0+21962+8143777b slirp4netns-1.2.3-1.module+el8.10.0+21962+8143777b toolbox-0.0.99.5-2.module+el8.10.0+21962+8143777b toolbox-tests-0.0.99.5-2.module+el8.10.0+21962+8143777b udica-0.2.6-21.module+el8.10.0+21962+8143777b aardvark-dns-1.10.0-1.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 buildah-1.33.7-2.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 buildah-tests-1.33.7-2.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 cockpit-podman-84.1-1.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 conmon-2.1.10-1.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 container-selinux-2.229.0-2.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 containernetworking-plugins-1.4.0-2.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 containers-common-1-81.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 crit-3.18-5.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 criu-3.18-5.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 criu-devel-3.18-5.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 criu-libs-3.18-5.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 crun-1.14.3-2.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 fuse-overlayfs-1.13-1.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 jose-10-2.el8_10.3 as a component of SUSE Liberty Linux 8 libjose-10-2.el8_10.3 as a component of SUSE Liberty Linux 8 libjose-devel-10-2.el8_10.3 as a component of SUSE Liberty Linux 8 libslirp-4.4.0-2.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 libslirp-devel-4.4.0-2.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 netavark-1.10.3-1.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 oci-seccomp-bpf-hook-1.2.10-1.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 podman-4.9.4-3.module+el8.10.0+21974+acd2159c as a component of SUSE Liberty Linux 8 podman-catatonit-4.9.4-3.module+el8.10.0+21974+acd2159c as a component of SUSE Liberty Linux 8 podman-docker-4.9.4-3.module+el8.10.0+21974+acd2159c as a component of SUSE Liberty Linux 8 podman-gvproxy-4.9.4-3.module+el8.10.0+21974+acd2159c as a component of SUSE Liberty Linux 8 podman-plugins-4.9.4-3.module+el8.10.0+21974+acd2159c as a component of SUSE Liberty Linux 8 podman-remote-4.9.4-3.module+el8.10.0+21974+acd2159c as a component of SUSE Liberty Linux 8 podman-tests-4.9.4-3.module+el8.10.0+21974+acd2159c as a component of SUSE Liberty Linux 8 python3-criu-3.18-5.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 python3-podman-4.9.0-1.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 runc-1.1.12-1.module+el8.10.0+21974+acd2159c as a component of SUSE Liberty Linux 8 skopeo-1.14.3-2.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 skopeo-tests-1.14.3-2.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 slirp4netns-1.2.3-1.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 toolbox-0.0.99.5-2.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 toolbox-tests-0.0.99.5-2.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 udica-0.2.6-21.module+el8.10.0+21962+8143777b as a component of SUSE Liberty Linux 8 buildah-1.33.7-2.el9_4 as a component of SUSE Liberty Linux 9 buildah-tests-1.33.7-2.el9_4 as a component of SUSE Liberty Linux 9 jose-14-1.el9 as a component of SUSE Liberty Linux 9 libjose-14-1.el9 as a component of SUSE Liberty Linux 9 libjose-devel-14-1.el9 as a component of SUSE Liberty Linux 9 podman-4.9.4-4.el9_4 as a component of SUSE Liberty Linux 9 podman-docker-4.9.4-4.el9_4 as a component of SUSE Liberty Linux 9 podman-plugins-4.9.4-4.el9_4 as a component of SUSE Liberty Linux 9 podman-remote-4.9.4-4.el9_4 as a component of SUSE Liberty Linux 9 podman-tests-4.9.4-4.el9_4 as a component of SUSE Liberty Linux 9 jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5. CVE-2024-28176 SUSE Liberty Linux 8:aardvark-dns-1.10.0-1.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:buildah-1.33.7-2.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:buildah-tests-1.33.7-2.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:cockpit-podman-84.1-1.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:conmon-2.1.10-1.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:container-selinux-2.229.0-2.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:containernetworking-plugins-1.4.0-2.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:containers-common-1-81.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:crit-3.18-5.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:criu-3.18-5.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:criu-devel-3.18-5.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:criu-libs-3.18-5.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:crun-1.14.3-2.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:fuse-overlayfs-1.13-1.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:jose-10-2.el8_10.3 SUSE Liberty Linux 8:libjose-10-2.el8_10.3 SUSE Liberty Linux 8:libjose-devel-10-2.el8_10.3 SUSE Liberty Linux 8:libslirp-4.4.0-2.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:libslirp-devel-4.4.0-2.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:netavark-1.10.3-1.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:oci-seccomp-bpf-hook-1.2.10-1.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:podman-4.9.4-3.module+el8.10.0+21974+acd2159c SUSE Liberty Linux 8:podman-catatonit-4.9.4-3.module+el8.10.0+21974+acd2159c SUSE Liberty Linux 8:podman-docker-4.9.4-3.module+el8.10.0+21974+acd2159c SUSE Liberty Linux 8:podman-gvproxy-4.9.4-3.module+el8.10.0+21974+acd2159c SUSE Liberty Linux 8:podman-plugins-4.9.4-3.module+el8.10.0+21974+acd2159c SUSE Liberty Linux 8:podman-remote-4.9.4-3.module+el8.10.0+21974+acd2159c SUSE Liberty Linux 8:podman-tests-4.9.4-3.module+el8.10.0+21974+acd2159c SUSE Liberty Linux 8:python3-criu-3.18-5.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:python3-podman-4.9.0-1.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:runc-1.1.12-1.module+el8.10.0+21974+acd2159c SUSE Liberty Linux 8:skopeo-1.14.3-2.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:skopeo-tests-1.14.3-2.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:slirp4netns-1.2.3-1.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:toolbox-0.0.99.5-2.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:toolbox-tests-0.0.99.5-2.module+el8.10.0+21962+8143777b SUSE Liberty Linux 8:udica-0.2.6-21.module+el8.10.0+21962+8143777b SUSE Liberty Linux 9:buildah-1.33.7-2.el9_4 SUSE Liberty Linux 9:buildah-tests-1.33.7-2.el9_4 SUSE Liberty Linux 9:jose-14-1.el9 SUSE Liberty Linux 9:libjose-14-1.el9 SUSE Liberty Linux 9:libjose-devel-14-1.el9 SUSE Liberty Linux 9:podman-4.9.4-4.el9_4 SUSE Liberty Linux 9:podman-docker-4.9.4-4.el9_4 SUSE Liberty Linux 9:podman-plugins-4.9.4-4.el9_4 SUSE Liberty Linux 9:podman-remote-4.9.4-4.el9_4 SUSE Liberty Linux 9:podman-tests-4.9.4-4.el9_4 moderate