Описание
The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| golang-github-dvsekhvalnov-jose2go | unfixed | package | ||
| golang-github-dvsekhvalnov-jose2go | no-dsa | trixie | package | |
| golang-github-dvsekhvalnov-jose2go | no-dsa | bookworm | package | |
| golang-github-dvsekhvalnov-jose2go | postponed | bullseye | package | |
| golang-github-dvsekhvalnov-jose2go | postponed | buster | package |
Примечания
https://github.com/dvsekhvalnov/jose2go/commit/a4584e9dd7128608fedbc67892eba9697f0d5317 (v1.6.0)
Связанные уязвимости
CVSS3: 7.5
ubuntu
почти 2 года назад
The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
CVSS3: 7.5
nvd
почти 2 года назад
The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
CVSS3: 5.3
github
почти 2 года назад
jose2go vulnerable to denial of service via large p2c value