Skip to content

Improper Handling of Highly Compressed Data (Data Amplification) in github.com/go-jose/go-jose/v4

Moderate
mcpherrinm published GHSA-c5q2-7r4c-mv6g Mar 7, 2024

Package

gomod github.com/go-jose/go-jose/v3 (Go)

Affected versions

< 3.0.3

Patched versions

3.0.3
gomod github.com/go-jose/go-jose/v4 (Go)
< 4.0.1
4.0.1
gomod gopkg.in/go-jose/go-jose.v2 (Go)
< 2.6.3
2.6.3

Description

Impact

An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). Thanks to Enze Wang@Alioth and Jianjun Chen@Zhongguancun Lab (@zer0yu and @chenjj) for reporting.

Patches

The problem is fixed in v4.0.1, v3.0.3, v2.6.3

Severity

Moderate
4.3
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CVE ID

CVE-2024-28180

Weaknesses

Credits