Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
f90210ca by Salvatore Bonaccorso at 2025-12-20T09:48:03+01:00
Add CVE-2024-29371/libjose4j-java
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1460,7 +1460,9 @@ CVE-2024-46062 (Miniconda3 macOS installers before
23.11.0-1 contain a local pri
CVE-2024-46060 (Anaconda3 macOS installers before 2024.06-1 contain a local
privilege ...)
NOT-FOR-US: Anaconda3 macOS installers
CVE-2024-29371 (In jose4j before 0.9.5, an attacker can cause a
Denial-of-Service (DoS ...)
- TODO: check
+ - libjose4j-java 0.9.6-1
+ NOTE: https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack
+ NOTE: Fixed by:
https://bitbucket.org/b_c/jose4j/commits/19a90a64c47bb07c4aa5462f1316d5c293d81fcf
CVE-2024-29370 (In python-jose 3.3.0 (specifically jwe.decrypt), a
vulnerability allow ...)
- python-jose <removed>
NOTE: https://github.com/mpdavis/python-jose/issues/344
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f90210cac99f78d6f09ca66955e625236a0b1084
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f90210cac99f78d6f09ca66955e625236a0b1084
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
