Bug 2347423 (CVE-2025-27144)
| Summary: | CVE-2025-27144 go-jose: Go JOSE's Parsing Vulnerable to Denial of Service | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | akostadi, alcohan, amasferr, amctagga, anjoseph, bdettelb, bkabrda, cbartlet, crizzo, danken, dmayorov, doconnor, dymurray, fdeutsch, gparvin, jaharrin, jburrell, jcantril, jeder, jlledo, jmatthew, jprabhak, jwendell, lball, manissin, mkudlej, mmakovy, mwringe, ngough, njean, oramraz, owatkins, pahickey, rcernich, rhaigner, rjohnson, rojacob, smullick, stirabos, teagle, thason, tjochec, veshanka, whayutin, wtam |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw was found in GO-JOSE. In affected versions, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code uses strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. This issue could be exploied by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2347478, 2347479, 2347481, 2347482, 2347463, 2347464, 2347465, 2347466, 2347467, 2347468, 2347469, 2347470, 2347471, 2347472, 2347473, 2347474, 2347475, 2347476, 2347477, 2347480, 2347483, 2347484, 2347485 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2025-02-24 23:01:07 UTC
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.18 Via RHSA-2025:3066 https://access.redhat.com/errata/RHSA-2025:3066 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.18 Via RHSA-2025:3068 https://access.redhat.com/errata/RHSA-2025:3068 This issue has been addressed in the following products: RHOL-6.0-RHEL-9 Via RHSA-2025:3132 https://access.redhat.com/errata/RHSA-2025:3132 This issue has been addressed in the following products: RHOL-6.1-RHEL-9 Via RHSA-2025:3131 https://access.redhat.com/errata/RHSA-2025:3131 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2025:3059 https://access.redhat.com/errata/RHSA-2025:3059 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2025:3061 https://access.redhat.com/errata/RHSA-2025:3061 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:3335 https://access.redhat.com/errata/RHSA-2025:3335 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2025:3301 https://access.redhat.com/errata/RHSA-2025:3301 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2025:3593 https://access.redhat.com/errata/RHSA-2025:3593 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.18 Via RHSA-2025:3775 https://access.redhat.com/errata/RHSA-2025:3775 This issue has been addressed in the following products: RHOL-5.9-RHEL-9 Via RHSA-2025:3906 https://access.redhat.com/errata/RHSA-2025:3906 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.18 Via RHSA-2025:4211 https://access.redhat.com/errata/RHSA-2025:4211 This issue has been addressed in the following products: RHODF-4.18-RHEL-9 Via RHSA-2025:4511 https://access.redhat.com/errata/RHSA-2025:4511 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.18 Via RHSA-2025:4427 https://access.redhat.com/errata/RHSA-2025:4427 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:7389 https://access.redhat.com/errata/RHSA-2025:7389 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:7391 https://access.redhat.com/errata/RHSA-2025:7391 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:7397 https://access.redhat.com/errata/RHSA-2025:7397 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:7407 https://access.redhat.com/errata/RHSA-2025:7407 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2025:7459 https://access.redhat.com/errata/RHSA-2025:7459 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2025:7462 https://access.redhat.com/errata/RHSA-2025:7462 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2025:7467 https://access.redhat.com/errata/RHSA-2025:7467 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2025:7479 https://access.redhat.com/errata/RHSA-2025:7479 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.18 Via RHSA-2025:4712 https://access.redhat.com/errata/RHSA-2025:4712 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2025:7669 https://access.redhat.com/errata/RHSA-2025:7669 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.19 Via RHSA-2024:11038 https://access.redhat.com/errata/RHSA-2024:11038 |