Every CVE Search/ Get API key

CVE-2024-28180

Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

4.3 MediumFix available

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

1.96%Up 1.9 points since Mar 9, 2024
90%50%10%1%

What each source reports

CVE List Score used 4.3

Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Record
CVE-2024-28180
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-409
Updated
2026-11-02
EUVDEUVD-2024-0896 4.3

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Record
EUVD-2024-0896
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-c5q2-7r4c-mv6g 4.3

Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

Impact

An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). Thanks to Enze Wang@Alioth and Jianjun Chen@Zhongguancun Lab (@zer0yu and @chenjj) for reporting.

Patches

The problem is fixed in the following packages and versions:

  • github.com/go-jose/go-jose/v4 version 4.0.1
  • github.com/go-jose/go-jose/v3 version 3.0.3
  • gopkg.in/go-jose/go-jose.v2 version 2.6.3

The problem will not be fixed in the following package because the package is archived:

  • gopkg.in/square/go-jose.v2
Record
GHSA-c5q2-7r4c-mv6g
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-409
Updated
2026-11-02
NVD 4.3

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Record
CVE-2024-28180
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-409
Updated
2026-11-02
OSVALPINE-CVE-2024-28180 4.3

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Record
ALPINE-CVE-2024-28180
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-03
OSV 4.3

Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Record
CVE-2024-28180
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-409
Updated
2026-11-02
Show 48 moreShow less
OSVDEBIAN-CVE-2024-28180 4.3

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Record
DEBIAN-CVE-2024-28180
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVGHSA-c5q2-7r4c-mv6g 4.3

Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

Impact

An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). Thanks to Enze Wang@Alioth and Jianjun Chen@Zhongguancun Lab (@zer0yu and @chenjj) for reporting.

Patches

The problem is fixed in the following packages and versions:

  • github.com/go-jose/go-jose/v4 version 4.0.1
  • github.com/go-jose/go-jose/v3 version 3.0.3
  • gopkg.in/go-jose/go-jose.v2 version 2.6.3

The problem will not be fixed in the following package because the package is archived:

  • gopkg.in/square/go-jose.v2
Record
GHSA-c5q2-7r4c-mv6g
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-409
Updated
2026-11-02
OSVOESA-2024-1472 4.3

cri-o security update

Open Container Initiative-based implementation of Kubernetes Container Runtime Interface.

Security Fix(es):

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)

Record
OESA-2024-1472
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2024-1473 4.3

cri-o security update

Open Container Initiative-based implementation of Kubernetes Container Runtime Interface.

Security Fix(es):

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)

Record
OESA-2024-1473
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2024-1474 4.3

cri-o security update

Open Container Initiative-based implementation of Kubernetes Container Runtime Interface.

Security Fix(es):

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)

Record
OESA-2024-1474
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2024-1644 4.3

skopeo security update

A command line utility that performs various operations on container images and image repositories

Security Fix(es):

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)

Record
OESA-2024-1644
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2024-1645 4.3

skopeo security update

A command line utility that performs various operations on container images and image repositories

Security Fix(es):

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)

Record
OESA-2024-1645
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2024-1701 4.3

skopeo security update

A command line utility that performs various operations on container images and image repositories

Security Fix(es):

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)

Record
OESA-2024-1701
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1687 4.3

skopeo security update

A command line utility that performs various operations on container images and image repositories

Security Fix(es):

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.(CVE-2024-28180)

Record
OESA-2025-1687
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHEA-2024:4022 7.5

Red Hat Enhancement Advisory: Red Hat OpenShift Pipelines Client tkn for 1.15.0 release

Record
RHEA-2024:4022
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:1456 5.9

Red Hat Security Advisory: OpenShift Container Platform 4.13.38 packages and security update

Record
RHSA-2024:1456
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:1563 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.15.6 packages and security update

Record
RHSA-2024:1563
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:1567 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.14.19 security update

Record
RHSA-2024:1567
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:1574 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.12.54 packages and security update

Record
RHSA-2024:1574
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:2049 8.6

Red Hat Security Advisory: OpenShift Container Platform 4.13.41 packages and security update

Record
RHSA-2024:2049
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:2054 4.3

Red Hat Security Advisory: OpenShift Container Platform 4.14.23 security update

Record
RHSA-2024:2054
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2024:2071 4.3

Red Hat Security Advisory: OpenShift Container Platform 4.15.11 packages and security update

Record
RHSA-2024:2071
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2024:2549 5.9

Red Hat Security Advisory: skopeo security and bug fix update

Record
RHSA-2024:2549
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:2669 8.6

Red Hat Security Advisory: OpenShift Container Platform 4.15.12 security update

Record
RHSA-2024:2669
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:2672 8.6

Red Hat Security Advisory: OpenShift Container Platform 4.14.24 packages and security update

Record
RHSA-2024:2672
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:2776 4.3

Red Hat Security Advisory: OpenShift Container Platform 4.15.13 packages and security update

Record
RHSA-2024:2776
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2024:2784 8.6

Red Hat Security Advisory: OpenShift Container Platform 4.12.57 security update

Record
RHSA-2024:2784
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:2877 8.6

Red Hat Security Advisory: OpenShift Container Platform 4.13.42 packages and security update

Record
RHSA-2024:2877
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:3254 8.6

Red Hat Security Advisory: container-tools:rhel8 security update

Record
RHSA-2024:3254
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:3351 4.3

Red Hat Security Advisory: OpenShift Container Platform 4.12.58 security update

Record
RHSA-2024:3351
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2024:3826 5.3

Red Hat Security Advisory: podman security and bug fix update

Record
RHSA-2024:3826
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2024:3827 5.3

Red Hat Security Advisory: buildah security and bug fix update

Record
RHSA-2024:3827
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2024:3968 5.3

Red Hat Security Advisory: container-tools:rhel8 bug fix and enhancement update

Record
RHSA-2024:3968
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVALSA-2024:2549 No score

Moderate: skopeo security and bug fix update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.

Security Fix(es):

  • golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786)

Bug Fix(es):

  • TRIAGE CVE-2024-24786 skopeo: golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON [almalinux-9] - AlmaLinux 9.4 0day (JIRA:AlmaLinux-28235)
  • skopeo: jose-go: improper handling of highly compressed data [almalinux-9] (JIRA:AlmaLinux-28736)
Record
ALSA-2024:2549
Updated
2026-11-02
OSVALSA-2024:3254 No score

Important: container-tools:rhel8 security update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

  • buildah: full container escape at build time (CVE-2024-1753)
  • golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
  • golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)
  • golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786)
  • jose-go: improper handling of highly compressed data (CVE-2024-28180)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2024:3254
Updated
2026-11-02
OSVALSA-2024:3826 No score

Moderate: podman security and bug fix update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fixes:

  • podman: jose-go: improper handling of highly compressed data (CVE-2024-28180)
  • podman: golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
  • podman: jose: resource exhaustion (CVE-2024-28176)
Record
ALSA-2024:3826
Updated
2026-11-02
OSVALSA-2024:3827 No score

Moderate: buildah security and bug fix update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

  • golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
  • jose-go: improper handling of highly compressed data (CVE-2024-28180)
  • buildah: jose: resource exhaustion (CVE-2024-28176)
Record
ALSA-2024:3827
Updated
2026-11-02
OSVALSA-2024:3968 No score

Moderate: container-tools:rhel8 bug fix and enhancement update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

  • podman: jose-go: improper handling of highly compressed data (CVE-2024-28180)
  • buildah: jose-go: improper handling of highly compressed data (CVE-2024-28180)
  • podman: jose-go: resource exhaustion (CVE-2024-28176)
  • buildah: jose-go: resource exhaustion (CVE-2024-28176)
  • skopeo: jose-go: resource exhaustion (CVE-2024-28176)

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

Record
ALSA-2024:3968
Updated
2026-11-02
OSVAZL-35837 No score

CVE-2024-28180 affecting package cert-manager for versions less than 1.11.2-14

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Record
AZL-35837
Updated
2026-11-02
OSVAZL-35839 No score

CVE-2024-28180 affecting package containerized-data-importer for versions less than 1.55.0-20

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Record
AZL-35839
Updated
2026-11-02
OSVAZL-35840 No score

CVE-2024-28180 affecting package dcos-cli for versions less than 1.2.0-19

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Record
AZL-35840
Updated
2026-11-02
OSVAZL-35842 No score

CVE-2024-28180 affecting package influxdb for versions less than 2.6.1-20

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Record
AZL-35842
Updated
2026-11-02
OSVAZL-35843 No score

CVE-2024-28180 affecting package keda for versions less than 2.4.0-26

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Record
AZL-35843
Updated
2026-11-02
OSVAZL-35844 No score

CVE-2024-28180 affecting package kube-vip-cloud-provider for versions less than 0.0.2-19

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Record
AZL-35844
Updated
2026-11-02
OSVAZL-35845 No score

CVE-2024-28180 affecting package kubernetes for versions less than 1.28.4-12

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Record
AZL-35845
Updated
2026-11-02
OSVAZL-35849 No score

CVE-2024-28180 affecting package moby-containerd for versions less than 1.6.26-9

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Record
AZL-35849
Updated
2026-11-02
OSVAZL-35850 No score

CVE-2024-28180 affecting package moby-containerd-cc for versions less than 1.7.7-9

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Record
AZL-35850
Updated
2026-11-02
OSVAZL-35855 No score

CVE-2024-28180 affecting package packer for versions less than 1.9.5-8

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Record
AZL-35855
Updated
2026-11-02
OSVAZL-35859 No score

CVE-2024-28180 affecting package rook for versions less than 1.6.2-23

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Record
AZL-35859
Updated
2026-11-02
OSVAZL-35860 No score

CVE-2024-28180 affecting package skopeo for versions less than 1.14.2-9

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Record
AZL-35860
Updated
2026-11-02
OSVAZL-35875 No score

CVE-2024-28180 affecting package cert-manager for versions less than 1.12.12-1

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Record
AZL-35875
Updated
2026-11-02
OSVAZL-35877 No score

CVE-2024-28180 affecting package containerd for versions less than 1.7.13-6

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Record
AZL-35877
Updated
2026-11-02
OSVAZL-35878 No score

CVE-2024-28180 affecting package containerized-data-importer for versions less than 1.57.0-9

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Record
AZL-35878
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/go-jose/go-jose/v4
Go
 before 4.0.1
4.0.1
github.com/go-jose/go-jose/v3
Go
 before 3.0.3
3.0.3
gopkg.in/go-jose/go-jose.v2
Go
 before 2.6.3
2.6.3
gopkg.in/square/go-jose.v2
Go
 through 2.6.0 None known
buildah
Alpine:v3.20
 before 1.35.4-r0
1.35.4-r0
buildah
Alpine:v3.21
 before 1.35.4-r0
1.35.4-r0
buildah
Alpine:v3.22
 before 1.35.4-r0
1.35.4-r0
buildah
Alpine:v3.23
 before 1.35.4-r0
1.35.4-r0
buildah
Alpine:v3.24
 before 1.35.4-r0
1.35.4-r0
skopeo
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2:1.14.3-2.el9_4
2:1.14.3-2.el9_4
Show 290 moreShow less
Affected packages
PackageAffectedFixed
skopeo-tests
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2:1.14.3-2.el9_4
2:1.14.3-2.el9_4
aardvark-dns
AlmaLinux:8
From an advisory covering 5 CVEs
 before 2:1.10.0-1.module_el8.10.0+3792+03eaed9c
2:1.10.0-1.module_el8.10.0+3792+03eaed9c
buildah
AlmaLinux:8
From an advisory covering 5 CVEs
 before 2:1.33.7-1.module_el8.10.0+3845+87b84552
2:1.33.7-1.module_el8.10.0+3845+87b84552
buildah-tests
AlmaLinux:8
From an advisory covering 5 CVEs
 before 2:1.33.7-1.module_el8.10.0+3845+87b84552
2:1.33.7-1.module_el8.10.0+3845+87b84552
cockpit-podman
AlmaLinux:8
From an advisory covering 5 CVEs
 before 84.1-1.module_el8.10.0+3792+03eaed9c
84.1-1.module_el8.10.0+3792+03eaed9c
conmon
AlmaLinux:8
From an advisory covering 5 CVEs
 before 3:2.1.10-1.module_el8.10.0+3845+87b84552
3:2.1.10-1.module_el8.10.0+3845+87b84552
container-selinux
AlmaLinux:8
From an advisory covering 5 CVEs
 before 2:2.229.0-2.module_el8.10.0+3792+03eaed9c
2:2.229.0-2.module_el8.10.0+3792+03eaed9c
containernetworking-plugins
AlmaLinux:8
From an advisory covering 5 CVEs
 before 1:1.4.0-2.module_el8.10.0+3792+03eaed9c
1:1.4.0-2.module_el8.10.0+3792+03eaed9c
containers-common
AlmaLinux:8
From an advisory covering 5 CVEs
 before 2:1-81.module_el8.10.0+3792+03eaed9c
2:1-81.module_el8.10.0+3792+03eaed9c
crit
AlmaLinux:8
From an advisory covering 5 CVEs
 before 3.18-5.module_el8.10.0+3845+87b84552
3.18-5.module_el8.10.0+3845+87b84552
criu
AlmaLinux:8
From an advisory covering 5 CVEs
 before 3.18-5.module_el8.10.0+3845+87b84552
3.18-5.module_el8.10.0+3845+87b84552
criu-devel
AlmaLinux:8
From an advisory covering 5 CVEs
 before 3.18-5.module_el8.10.0+3845+87b84552
3.18-5.module_el8.10.0+3845+87b84552
criu-libs
AlmaLinux:8
From an advisory covering 5 CVEs
 before 3.18-5.module_el8.10.0+3845+87b84552
3.18-5.module_el8.10.0+3845+87b84552
crun
AlmaLinux:8
From an advisory covering 5 CVEs
 before 1.14.3-2.module_el8.10.0+3845+87b84552
1.14.3-2.module_el8.10.0+3845+87b84552
fuse-overlayfs
AlmaLinux:8
From an advisory covering 5 CVEs
 before 1.13-1.module_el8.10.0+3792+03eaed9c
1.13-1.module_el8.10.0+3792+03eaed9c
libslirp
AlmaLinux:8
From an advisory covering 5 CVEs
 before 4.4.0-2.module_el8.10.0+3845+87b84552
4.4.0-2.module_el8.10.0+3845+87b84552
libslirp-devel
AlmaLinux:8
From an advisory covering 5 CVEs
 before 4.4.0-2.module_el8.10.0+3845+87b84552
4.4.0-2.module_el8.10.0+3845+87b84552
netavark
AlmaLinux:8
From an advisory covering 5 CVEs
 before 2:1.10.3-1.module_el8.10.0+3845+87b84552
2:1.10.3-1.module_el8.10.0+3845+87b84552
oci-seccomp-bpf-hook
AlmaLinux:8
From an advisory covering 5 CVEs
 before 1.2.10-1.module_el8.10.0+3792+03eaed9c
1.2.10-1.module_el8.10.0+3792+03eaed9c
podman
AlmaLinux:8
From an advisory covering 5 CVEs
 before 4:4.9.4-1.module_el8.10.0+3845+87b84552
4:4.9.4-1.module_el8.10.0+3845+87b84552
podman-catatonit
AlmaLinux:8
From an advisory covering 5 CVEs
 before 4:4.9.4-1.module_el8.10.0+3845+87b84552
4:4.9.4-1.module_el8.10.0+3845+87b84552
podman-docker
AlmaLinux:8
From an advisory covering 5 CVEs
 before 4:4.9.4-1.module_el8.10.0+3845+87b84552
4:4.9.4-1.module_el8.10.0+3845+87b84552
podman-gvproxy
AlmaLinux:8
From an advisory covering 5 CVEs
 before 4:4.9.4-1.module_el8.10.0+3845+87b84552
4:4.9.4-1.module_el8.10.0+3845+87b84552
podman-plugins
AlmaLinux:8
From an advisory covering 5 CVEs
 before 4:4.9.4-1.module_el8.10.0+3845+87b84552
4:4.9.4-1.module_el8.10.0+3845+87b84552
podman-remote
AlmaLinux:8
From an advisory covering 5 CVEs
 before 4:4.9.4-1.module_el8.10.0+3845+87b84552
4:4.9.4-1.module_el8.10.0+3845+87b84552
podman-tests
AlmaLinux:8
From an advisory covering 5 CVEs
 before 4:4.9.4-1.module_el8.10.0+3845+87b84552
4:4.9.4-1.module_el8.10.0+3845+87b84552
python3-criu
AlmaLinux:8
From an advisory covering 5 CVEs
 before 3.18-5.module_el8.10.0+3845+87b84552
3.18-5.module_el8.10.0+3845+87b84552
python3-podman
AlmaLinux:8
From an advisory covering 5 CVEs
 before 4.9.0-1.module_el8.10.0+3792+03eaed9c
4.9.0-1.module_el8.10.0+3792+03eaed9c
runc
AlmaLinux:8
From an advisory covering 5 CVEs
 before 1:1.1.12-1.module_el8.10.0+3845+87b84552
1:1.1.12-1.module_el8.10.0+3845+87b84552
skopeo
AlmaLinux:8
From an advisory covering 5 CVEs
 before 2:1.14.3-2.module_el8.10.0+3845+87b84552
2:1.14.3-2.module_el8.10.0+3845+87b84552
skopeo-tests
AlmaLinux:8
From an advisory covering 5 CVEs
 before 2:1.14.3-2.module_el8.10.0+3845+87b84552
2:1.14.3-2.module_el8.10.0+3845+87b84552
slirp4netns
AlmaLinux:8
From an advisory covering 5 CVEs
 before 1.2.3-1.module_el8.10.0+3845+87b84552
1.2.3-1.module_el8.10.0+3845+87b84552
toolbox
AlmaLinux:8
From an advisory covering 5 CVEs
 before 0.0.99.5-2.module_el8.10.0+3845+87b84552
0.0.99.5-2.module_el8.10.0+3845+87b84552
toolbox-tests
AlmaLinux:8
From an advisory covering 5 CVEs
 before 0.0.99.5-2.module_el8.10.0+3845+87b84552
0.0.99.5-2.module_el8.10.0+3845+87b84552
udica
AlmaLinux:8
From an advisory covering 5 CVEs
 before 0.2.6-21.module_el8.10.0+3845+87b84552
0.2.6-21.module_el8.10.0+3845+87b84552
podman
AlmaLinux:9
From an advisory covering 3 CVEs
 before 4:4.9.4-4.el9_4
4:4.9.4-4.el9_4
podman-docker
AlmaLinux:9
From an advisory covering 3 CVEs
 before 4:4.9.4-4.el9_4
4:4.9.4-4.el9_4
podman-plugins
AlmaLinux:9
From an advisory covering 3 CVEs
 before 4:4.9.4-4.el9_4
4:4.9.4-4.el9_4
podman-remote
AlmaLinux:9
From an advisory covering 3 CVEs
 before 4:4.9.4-4.el9_4
4:4.9.4-4.el9_4
podman-tests
AlmaLinux:9
From an advisory covering 3 CVEs
 before 4:4.9.4-4.el9_4
4:4.9.4-4.el9_4
buildah
AlmaLinux:9
From an advisory covering 3 CVEs
 before 2:1.33.7-2.el9_4
2:1.33.7-2.el9_4
buildah-tests
AlmaLinux:9
From an advisory covering 3 CVEs
 before 2:1.33.7-2.el9_4
2:1.33.7-2.el9_4
aardvark-dns
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2:1.10.0-1.module_el8.10.0+3792+03eaed9c
2:1.10.0-1.module_el8.10.0+3792+03eaed9c
aardvark-dns
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2:1.10.0-1.module_el8.10.0+3858+6ad51f9f
2:1.10.0-1.module_el8.10.0+3858+6ad51f9f
buildah
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2:1.33.7-2.module_el8.10.0+3858+6ad51f9f
2:1.33.7-2.module_el8.10.0+3858+6ad51f9f
buildah-tests
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2:1.33.7-2.module_el8.10.0+3858+6ad51f9f
2:1.33.7-2.module_el8.10.0+3858+6ad51f9f
cockpit-podman
AlmaLinux:8
From an advisory covering 2 CVEs
 before 84.1-1.module_el8.10.0+3858+6ad51f9f
84.1-1.module_el8.10.0+3858+6ad51f9f
conmon
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3:2.1.10-1.module_el8.10.0+3858+6ad51f9f
3:2.1.10-1.module_el8.10.0+3858+6ad51f9f
conmon
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3:2.1.10-1.module_el8.10.0+3845+87b84552
3:2.1.10-1.module_el8.10.0+3845+87b84552
container-selinux
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2:2.229.0-2.module_el8.10.0+3858+6ad51f9f
2:2.229.0-2.module_el8.10.0+3858+6ad51f9f
containernetworking-plugins
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:1.4.0-2.module_el8.10.0+3858+6ad51f9f
1:1.4.0-2.module_el8.10.0+3858+6ad51f9f
containernetworking-plugins
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1:1.4.0-2.module_el8.10.0+3792+03eaed9c
1:1.4.0-2.module_el8.10.0+3792+03eaed9c
containers-common
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2:1-81.module_el8.10.0+3858+6ad51f9f
2:1-81.module_el8.10.0+3858+6ad51f9f
containers-common
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2:1-81.module_el8.10.0+3792+03eaed9c
2:1-81.module_el8.10.0+3792+03eaed9c
crit
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3.18-5.module_el8.10.0+3845+87b84552
3.18-5.module_el8.10.0+3845+87b84552
crit
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3.18-5.module_el8.10.0+3858+6ad51f9f
3.18-5.module_el8.10.0+3858+6ad51f9f
criu
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3.18-5.module_el8.10.0+3845+87b84552
3.18-5.module_el8.10.0+3845+87b84552
criu
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3.18-5.module_el8.10.0+3858+6ad51f9f
3.18-5.module_el8.10.0+3858+6ad51f9f
criu-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3.18-5.module_el8.10.0+3858+6ad51f9f
3.18-5.module_el8.10.0+3858+6ad51f9f
criu-libs
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3.18-5.module_el8.10.0+3845+87b84552
3.18-5.module_el8.10.0+3845+87b84552
crun
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.14.3-2.module_el8.10.0+3845+87b84552
1.14.3-2.module_el8.10.0+3845+87b84552
crun
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.14.3-2.module_el8.10.0+3858+6ad51f9f
1.14.3-2.module_el8.10.0+3858+6ad51f9f
fuse-overlayfs
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.13-1.module_el8.10.0+3792+03eaed9c
1.13-1.module_el8.10.0+3792+03eaed9c
libslirp
AlmaLinux:8
From an advisory covering 2 CVEs
 before 4.4.0-2.module_el8.10.0+3858+6ad51f9f
4.4.0-2.module_el8.10.0+3858+6ad51f9f
libslirp
AlmaLinux:8
From an advisory covering 2 CVEs
 before 4.4.0-2.module_el8.10.0+3845+87b84552
4.4.0-2.module_el8.10.0+3845+87b84552
libslirp-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 4.4.0-2.module_el8.10.0+3858+6ad51f9f
4.4.0-2.module_el8.10.0+3858+6ad51f9f
libslirp-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 4.4.0-2.module_el8.10.0+3845+87b84552
4.4.0-2.module_el8.10.0+3845+87b84552
netavark
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2:1.10.3-1.module_el8.10.0+3858+6ad51f9f
2:1.10.3-1.module_el8.10.0+3858+6ad51f9f
netavark
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2:1.10.3-1.module_el8.10.0+3845+87b84552
2:1.10.3-1.module_el8.10.0+3845+87b84552
oci-seccomp-bpf-hook
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.2.10-1.module_el8.10.0+3792+03eaed9c
1.2.10-1.module_el8.10.0+3792+03eaed9c
podman
AlmaLinux:8
From an advisory covering 2 CVEs
 before 4:4.9.4-3.module_el8.10.0+3858+6ad51f9f
4:4.9.4-3.module_el8.10.0+3858+6ad51f9f
podman-catatonit
AlmaLinux:8
From an advisory covering 2 CVEs
 before 4:4.9.4-3.module_el8.10.0+3858+6ad51f9f
4:4.9.4-3.module_el8.10.0+3858+6ad51f9f
podman-docker
AlmaLinux:8
From an advisory covering 2 CVEs
 before 4:4.9.4-3.module_el8.10.0+3858+6ad51f9f
4:4.9.4-3.module_el8.10.0+3858+6ad51f9f
podman-gvproxy
AlmaLinux:8
From an advisory covering 2 CVEs
 before 4:4.9.4-3.module_el8.10.0+3858+6ad51f9f
4:4.9.4-3.module_el8.10.0+3858+6ad51f9f
podman-plugins
AlmaLinux:8
From an advisory covering 2 CVEs
 before 4:4.9.4-3.module_el8.10.0+3858+6ad51f9f
4:4.9.4-3.module_el8.10.0+3858+6ad51f9f
podman-remote
AlmaLinux:8
From an advisory covering 2 CVEs
 before 4:4.9.4-3.module_el8.10.0+3858+6ad51f9f
4:4.9.4-3.module_el8.10.0+3858+6ad51f9f
cert-manager
Azure Linux:2
 before 1.11.2-14
1.11.2-14
containerized-data-importer
Azure Linux:2
 before 1.55.0-20
1.55.0-20
dcos-cli
Azure Linux:2
 before 1.2.0-19
1.2.0-19
influxdb
Azure Linux:2
 before 2.6.1-20
2.6.1-20
keda
Azure Linux:2
 before 2.4.0-26
2.4.0-26
kube-vip-cloud-provider
Azure Linux:2
 before 0.0.2-19
0.0.2-19
kubernetes
Azure Linux:2
 before 1.28.4-12
1.28.4-12
moby-containerd
Azure Linux:2
 before 1.6.26-9
1.6.26-9
moby-containerd-cc
Azure Linux:2
 before 1.7.7-9
1.7.7-9
packer
Azure Linux:2
 before 1.9.5-8
1.9.5-8
rook
Azure Linux:2
 before 1.6.2-23
1.6.2-23
skopeo
Azure Linux:2
 before 1.14.2-9
1.14.2-9
cert-manager
Azure Linux:3
 before 1.12.12-1
1.12.12-1
containerd
Azure Linux:3
 before 1.7.13-6
1.7.13-6
containerized-data-importer
Azure Linux:3
 before 1.57.0-9
1.57.0-9
dcos-cli
Azure Linux:3
 before 1.2.0-16
1.2.0-16
influxdb
Azure Linux:3
 before 2.7.3-9
2.7.3-9
keda
Azure Linux:3
 before 2.14.0-1
2.14.0-1
kubernetes
Azure Linux:3
 before 1.30.1-1
1.30.1-1
moby-containerd-cc
Azure Linux:3
 before 1.7.7-6
1.7.7-6
packer
Azure Linux:3
 before 1.9.5-6
1.9.5-6
skopeo
Azure Linux:3
 before 1.14.4-1
1.14.4-1
telegraf
Azure Linux:2
 before 1.29.4-8
1.29.4-8
cri-o
Azure Linux:2
 before 1.21.7-2
1.21.7-2
telegraf
Azure Linux:3
 before 1.31.0-1
1.31.0-1
buildah
Azure Linux:2
 through 1.18.0-29 None known
podman
Azure Linux:2
 through 4.1.1-26 None known
buildah
Azure Linux:3
 before 1.41.4-2
1.41.4-2
podman
Azure Linux:3
 before 5.6.1-2
5.6.1-2
skopeo
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 2:1.11.2-0.1.el9.tuxcare.els4
2:1.11.2-0.1.el9.tuxcare.els4
skopeo-tests
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 2:1.11.2-0.1.el9.tuxcare.els4
2:1.11.2-0.1.el9.tuxcare.els4
golang-github-go-jose-go-jose
Debian:13
 before 4.0.1-1
4.0.1-1
golang-github-go-jose-go-jose
Debian:14
 before 4.0.1-1
4.0.1-1
golang-gopkg-square-go-jose.v2
Debian:12
 All versions, plus listed versions
2.6.0-22.6.3-12.6.3-22.6.3-32.6.3-42.6.3-4~exp0
 None known
golang-gopkg-square-go-jose.v2
Debian:13
 before 2.6.3-1
2.6.3-1
golang-gopkg-square-go-jose.v2
Debian:14
 before 2.6.3-1
2.6.3-1
gopkg.in/square/go-jose.v2
Go
 All versions None known
buildah
Mageia:9
From an advisory covering 8 CVEs
 before 1.37.4-1.mga9
1.37.4-1.mga9
podman
Mageia:9
From an advisory covering 8 CVEs
 before 4.9.5-1.mga9
4.9.5-1.mga9
skopeo
Mageia:9
From an advisory covering 8 CVEs
 before 1.16.1-1.mga9
1.16.1-1.mga9
cri-o
openEuler:22.03-LTS-SP1
 before 1.23.2-11.oe2203sp1
1.23.2-11.oe2203sp1
cri-o
openEuler:22.03-LTS-SP2
 before 1.23.2-11.oe2203sp2
1.23.2-11.oe2203sp2
cri-o
openEuler:22.03-LTS-SP3
 before 1.23.2-11.oe2203sp3
1.23.2-11.oe2203sp3
skopeo
openEuler:22.03-LTS-SP1
 before 1.5.2-7.oe2203sp1
1.5.2-7.oe2203sp1
skopeo
openEuler:22.03-LTS-SP2
 before 1.5.2-6.oe2203sp2
1.5.2-6.oe2203sp2
skopeo
openEuler:22.03-LTS-SP3
 before 1.8.0-5.oe2203sp3
1.8.0-5.oe2203sp3
skopeo
openEuler:20.03-LTS-SP4
 before 1.1.0-12.oe2003sp4
1.1.0-12.oe2003sp4
openshift-pipelines-client
Red Hat:openshift_pipelines:1.15::el8
From an advisory covering 5 CVEs
 before 0:1.15.0-11496.el8
0:1.15.0-11496.el8
openshift-pipelines-client-redistributable
Red Hat:openshift_pipelines:1.15::el8
From an advisory covering 5 CVEs
 before 0:1.15.0-11496.el8
0:1.15.0-11496.el8
cri-o
Red Hat:openshift:4.13::el8
From an advisory covering 2 CVEs
 before 0:1.26.5-10.rhaos4.13.gita08b329.el8
0:1.26.5-10.rhaos4.13.gita08b329.el8
cri-o-debuginfo
Red Hat:openshift:4.13::el8
From an advisory covering 2 CVEs
 before 0:1.26.5-10.rhaos4.13.gita08b329.el8
0:1.26.5-10.rhaos4.13.gita08b329.el8
cri-o-debugsource
Red Hat:openshift:4.13::el8
From an advisory covering 2 CVEs
 before 0:1.26.5-10.rhaos4.13.gita08b329.el8
0:1.26.5-10.rhaos4.13.gita08b329.el8
cri-o
Red Hat:openshift:4.13::el9
From an advisory covering 2 CVEs
 before 0:1.26.5-10.rhaos4.13.gita08b329.el9
0:1.26.5-10.rhaos4.13.gita08b329.el9
cri-o-debuginfo
Red Hat:openshift:4.13::el9
From an advisory covering 2 CVEs
 before 0:1.26.5-10.rhaos4.13.gita08b329.el9
0:1.26.5-10.rhaos4.13.gita08b329.el9
cri-o-debugsource
Red Hat:openshift:4.13::el9
From an advisory covering 2 CVEs
 before 0:1.26.5-10.rhaos4.13.gita08b329.el9
0:1.26.5-10.rhaos4.13.gita08b329.el9
buildah
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 1:1.29.1-20.3.rhaos4.15.el8
1:1.29.1-20.3.rhaos4.15.el8
buildah-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 1:1.29.1-20.3.rhaos4.15.el8
1:1.29.1-20.3.rhaos4.15.el8
buildah-debugsource
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 1:1.29.1-20.3.rhaos4.15.el8
1:1.29.1-20.3.rhaos4.15.el8
buildah-tests
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 1:1.29.1-20.3.rhaos4.15.el8
1:1.29.1-20.3.rhaos4.15.el8
buildah-tests-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 1:1.29.1-20.3.rhaos4.15.el8
1:1.29.1-20.3.rhaos4.15.el8
butane
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 0:0.20.0-1.1.rhaos4.15.el8
0:0.20.0-1.1.rhaos4.15.el8
butane-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 0:0.20.0-1.1.rhaos4.15.el8
0:0.20.0-1.1.rhaos4.15.el8
butane-debugsource
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 0:0.20.0-1.1.rhaos4.15.el8
0:0.20.0-1.1.rhaos4.15.el8
butane-redistributable
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 0:0.20.0-1.1.rhaos4.15.el8
0:0.20.0-1.1.rhaos4.15.el8
containernetworking-plugins
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 1:1.4.0-1.2.rhaos4.15.el8
1:1.4.0-1.2.rhaos4.15.el8
containernetworking-plugins-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 1:1.4.0-1.2.rhaos4.15.el8
1:1.4.0-1.2.rhaos4.15.el8
containernetworking-plugins-debugsource
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 1:1.4.0-1.2.rhaos4.15.el8
1:1.4.0-1.2.rhaos4.15.el8
cri-o
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 0:1.28.4-8.rhaos4.15.git24f50b9.el8
0:1.28.4-8.rhaos4.15.git24f50b9.el8
cri-o-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 0:1.28.4-8.rhaos4.15.git24f50b9.el8
0:1.28.4-8.rhaos4.15.git24f50b9.el8
cri-o-debugsource
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 0:1.28.4-8.rhaos4.15.git24f50b9.el8
0:1.28.4-8.rhaos4.15.git24f50b9.el8
cri-tools
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 0:1.28.0-3.1.el8
0:1.28.0-3.1.el8
cri-tools-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 0:1.28.0-3.1.el8
0:1.28.0-3.1.el8
cri-tools-debugsource
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 0:1.28.0-3.1.el8
0:1.28.0-3.1.el8
openshift-clients
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 0:4.15.0-202403211240.p0.g62c4d45.assembly.stream.el8
0:4.15.0-202403211240.p0.g62c4d45.assembly.stream.el8
openshift-clients-redistributable
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 0:4.15.0-202403211240.p0.g62c4d45.assembly.stream.el8
0:4.15.0-202403211240.p0.g62c4d45.assembly.stream.el8
ose-aws-ecr-image-credential-provider
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 0:4.15.0-202403211549.p0.g2e3cca1.assembly.stream.el8
0:4.15.0-202403211549.p0.g2e3cca1.assembly.stream.el8
podman
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-21.1.rhaos4.15.el8
3:4.4.1-21.1.rhaos4.15.el8
podman-catatonit
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-21.1.rhaos4.15.el8
3:4.4.1-21.1.rhaos4.15.el8
podman-catatonit-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-21.1.rhaos4.15.el8
3:4.4.1-21.1.rhaos4.15.el8
podman-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-21.1.rhaos4.15.el8
3:4.4.1-21.1.rhaos4.15.el8
podman-debugsource
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-21.1.rhaos4.15.el8
3:4.4.1-21.1.rhaos4.15.el8
podman-docker
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-21.1.rhaos4.15.el8
3:4.4.1-21.1.rhaos4.15.el8
podman-gvproxy
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-21.1.rhaos4.15.el8
3:4.4.1-21.1.rhaos4.15.el8
podman-gvproxy-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-21.1.rhaos4.15.el8
3:4.4.1-21.1.rhaos4.15.el8
podman-plugins
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-21.1.rhaos4.15.el8
3:4.4.1-21.1.rhaos4.15.el8
podman-plugins-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-21.1.rhaos4.15.el8
3:4.4.1-21.1.rhaos4.15.el8
podman-remote
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-21.1.rhaos4.15.el8
3:4.4.1-21.1.rhaos4.15.el8
podman-remote-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-21.1.rhaos4.15.el8
3:4.4.1-21.1.rhaos4.15.el8
podman-tests
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 3:4.4.1-21.1.rhaos4.15.el8
3:4.4.1-21.1.rhaos4.15.el8
runc
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 4:1.1.12-1.1.rhaos4.15.el8
4:1.1.12-1.1.rhaos4.15.el8
runc-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 4:1.1.12-1.1.rhaos4.15.el8
4:1.1.12-1.1.rhaos4.15.el8
runc-debugsource
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 4:1.1.12-1.1.rhaos4.15.el8
4:1.1.12-1.1.rhaos4.15.el8
skopeo
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 2:1.11.2-21.2.rhaos4.15.el8
2:1.11.2-21.2.rhaos4.15.el8
skopeo-debuginfo
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 2:1.11.2-21.2.rhaos4.15.el8
2:1.11.2-21.2.rhaos4.15.el8
skopeo-debugsource
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 2:1.11.2-21.2.rhaos4.15.el8
2:1.11.2-21.2.rhaos4.15.el8
skopeo-tests
Red Hat:openshift:4.15::el8
From an advisory covering 3 CVEs
 before 2:1.11.2-21.2.rhaos4.15.el8
2:1.11.2-21.2.rhaos4.15.el8
buildah
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 1:1.29.1-20.3.rhaos4.15.el9
1:1.29.1-20.3.rhaos4.15.el9
buildah-debuginfo
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 1:1.29.1-20.3.rhaos4.15.el9
1:1.29.1-20.3.rhaos4.15.el9
buildah-debugsource
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 1:1.29.1-20.3.rhaos4.15.el9
1:1.29.1-20.3.rhaos4.15.el9
buildah-tests
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 1:1.29.1-20.3.rhaos4.15.el9
1:1.29.1-20.3.rhaos4.15.el9
buildah-tests-debuginfo
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 1:1.29.1-20.3.rhaos4.15.el9
1:1.29.1-20.3.rhaos4.15.el9
cri-o
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 0:1.28.4-8.rhaos4.15.git24f50b9.el9
0:1.28.4-8.rhaos4.15.git24f50b9.el9
cri-o-debuginfo
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 0:1.28.4-8.rhaos4.15.git24f50b9.el9
0:1.28.4-8.rhaos4.15.git24f50b9.el9
cri-o-debugsource
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 0:1.28.4-8.rhaos4.15.git24f50b9.el9
0:1.28.4-8.rhaos4.15.git24f50b9.el9
cri-tools
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 0:1.28.0-3.1.el9
0:1.28.0-3.1.el9
cri-tools-debuginfo
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 0:1.28.0-3.1.el9
0:1.28.0-3.1.el9
cri-tools-debugsource
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 0:1.28.0-3.1.el9
0:1.28.0-3.1.el9
ignition
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 0:2.16.2-2.1.rhaos4.15.el9
0:2.16.2-2.1.rhaos4.15.el9
ignition-debuginfo
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 0:2.16.2-2.1.rhaos4.15.el9
0:2.16.2-2.1.rhaos4.15.el9
ignition-debugsource
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 0:2.16.2-2.1.rhaos4.15.el9
0:2.16.2-2.1.rhaos4.15.el9
ignition-validate
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 0:2.16.2-2.1.rhaos4.15.el9
0:2.16.2-2.1.rhaos4.15.el9
ignition-validate-debuginfo
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 0:2.16.2-2.1.rhaos4.15.el9
0:2.16.2-2.1.rhaos4.15.el9
openshift-clients
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 0:4.15.0-202403211240.p0.g62c4d45.assembly.stream.el9
0:4.15.0-202403211240.p0.g62c4d45.assembly.stream.el9
openshift-clients-redistributable
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 0:4.15.0-202403211240.p0.g62c4d45.assembly.stream.el9
0:4.15.0-202403211240.p0.g62c4d45.assembly.stream.el9
ose-aws-ecr-image-credential-provider
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 0:4.15.0-202403211549.p0.g2e3cca1.assembly.stream.el9
0:4.15.0-202403211549.p0.g2e3cca1.assembly.stream.el9
podman
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 3:4.4.1-21.1.rhaos4.15.el9
3:4.4.1-21.1.rhaos4.15.el9
podman-debuginfo
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 3:4.4.1-21.1.rhaos4.15.el9
3:4.4.1-21.1.rhaos4.15.el9
podman-debugsource
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 3:4.4.1-21.1.rhaos4.15.el9
3:4.4.1-21.1.rhaos4.15.el9
podman-docker
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 3:4.4.1-21.1.rhaos4.15.el9
3:4.4.1-21.1.rhaos4.15.el9
podman-gvproxy
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 3:4.4.1-21.1.rhaos4.15.el9
3:4.4.1-21.1.rhaos4.15.el9
podman-gvproxy-debuginfo
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 3:4.4.1-21.1.rhaos4.15.el9
3:4.4.1-21.1.rhaos4.15.el9
podman-plugins
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 3:4.4.1-21.1.rhaos4.15.el9
3:4.4.1-21.1.rhaos4.15.el9
podman-plugins-debuginfo
Red Hat:openshift:4.15::el9
From an advisory covering 3 CVEs
 before 3:4.4.1-21.1.rhaos4.15.el9
3:4.4.1-21.1.rhaos4.15.el9
skopeo
Rocky Linux:9
From an advisory covering 2 CVEs
 before 2:1.14.3-2.el9_4
2:1.14.3-2.el9_4
podman
Rocky Linux:9
From an advisory covering 3 CVEs
 before 4:4.9.4-4.el9_4
4:4.9.4-4.el9_4
buildah
Rocky Linux:9
From an advisory covering 3 CVEs
 before 2:1.33.7-2.el9_4
2:1.33.7-2.el9_4
aardvark-dns
Rocky Linux:8
From an advisory covering 2 CVEs
 before 2:1.10.0-1.module+el8.10.0+1815+5fe7415e
2:1.10.0-1.module+el8.10.0+1815+5fe7415e
buildah
Rocky Linux:8
From an advisory covering 2 CVEs
 before 2:1.33.7-2.module+el8.10.0+1829+9bb2696f
2:1.33.7-2.module+el8.10.0+1829+9bb2696f
cockpit-podman
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:84.1-1.module+el8.10.0+1815+5fe7415e
0:84.1-1.module+el8.10.0+1815+5fe7415e
conmon
Rocky Linux:8
From an advisory covering 2 CVEs
 before 3:2.1.10-1.module+el8.10.0+1815+5fe7415e
3:2.1.10-1.module+el8.10.0+1815+5fe7415e
containernetworking-plugins
Rocky Linux:8
From an advisory covering 2 CVEs
 before 1:1.4.0-2.module+el8.10.0+1815+5fe7415e
1:1.4.0-2.module+el8.10.0+1815+5fe7415e
containers-common
Rocky Linux:8
From an advisory covering 2 CVEs
 before 2:1-81.module+el8.10.0+1815+5fe7415e
2:1-81.module+el8.10.0+1815+5fe7415e
container-selinux
Rocky Linux:8
From an advisory covering 2 CVEs
 before 2:2.229.0-2.module+el8.10.0+1815+5fe7415e
2:2.229.0-2.module+el8.10.0+1815+5fe7415e
criu
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:3.18-5.module+el8.10.0+1815+5fe7415e
0:3.18-5.module+el8.10.0+1815+5fe7415e
crun
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.14.3-2.module+el8.10.0+1815+5fe7415e
0:1.14.3-2.module+el8.10.0+1815+5fe7415e
fuse-overlayfs
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.13-1.module+el8.10.0+1815+5fe7415e
0:1.13-1.module+el8.10.0+1815+5fe7415e
libslirp
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:4.4.0-2.module+el8.10.0+1815+5fe7415e
0:4.4.0-2.module+el8.10.0+1815+5fe7415e
netavark
Rocky Linux:8
From an advisory covering 2 CVEs
 before 2:1.10.3-1.module+el8.10.0+1815+5fe7415e
2:1.10.3-1.module+el8.10.0+1815+5fe7415e
oci-seccomp-bpf-hook
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.2.10-1.module+el8.10.0+1815+5fe7415e
0:1.2.10-1.module+el8.10.0+1815+5fe7415e
podman
Rocky Linux:8
From an advisory covering 2 CVEs
 before 4:4.9.4-3.module+el8.10.0+1829+9bb2696f
4:4.9.4-3.module+el8.10.0+1829+9bb2696f
skopeo
Rocky Linux:8
From an advisory covering 2 CVEs
 before 2:1.14.3-2.module+el8.10.0+1815+5fe7415e
2:1.14.3-2.module+el8.10.0+1815+5fe7415e
python-podman
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:4.9.0-1.module+el8.10.0+1815+5fe7415e
0:4.9.0-1.module+el8.10.0+1815+5fe7415e
runc
Rocky Linux:8
From an advisory covering 2 CVEs
 before 1:1.1.12-1.module+el8.10.0+1815+5fe7415e
1:1.1.12-1.module+el8.10.0+1815+5fe7415e
slirp4netns
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.2.3-1.module+el8.10.0+1815+5fe7415e
0:1.2.3-1.module+el8.10.0+1815+5fe7415e
toolbox
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2
0:0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2
udica
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:0.2.6-21.module+el8.10.0+1815+5fe7415e
0:0.2.6-21.module+el8.10.0+1815+5fe7415e
skopeo
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 2 CVEs
 before 1.14.4-150300.11.11.1
1.14.4-150300.11.11.1
skopeo
SUSE:Linux Enterprise Module for Basesystem 15 SP5
From an advisory covering 2 CVEs
 before 1.14.4-150300.11.11.1
1.14.4-150300.11.11.1
skopeo
SUSE:Linux Enterprise Module for Basesystem 15 SP6
From an advisory covering 2 CVEs
 before 1.14.4-150300.11.11.1
1.14.4-150300.11.11.1
skopeo
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
From an advisory covering 2 CVEs
 before 1.14.4-150300.11.11.1
1.14.4-150300.11.11.1
skopeo
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 2 CVEs
 before 1.14.4-150300.11.11.1
1.14.4-150300.11.11.1
skopeo
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 1.14.4-150300.11.11.1
1.14.4-150300.11.11.1
skopeo
SUSE:Linux Enterprise Server 15 SP3-LTSS
From an advisory covering 2 CVEs
 before 1.14.4-150300.11.11.1
1.14.4-150300.11.11.1
skopeo
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 1.14.4-150300.11.11.1
1.14.4-150300.11.11.1
skopeo
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
From an advisory covering 2 CVEs
 before 1.14.4-150300.11.11.1
1.14.4-150300.11.11.1
skopeo
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 2 CVEs
 before 1.14.4-150300.11.11.1
1.14.4-150300.11.11.1
skopeo
SUSE:Manager Proxy 4.3
From an advisory covering 2 CVEs
 before 1.14.4-150300.11.11.1
1.14.4-150300.11.11.1
skopeo
SUSE:Manager Server 4.3
From an advisory covering 2 CVEs
 before 1.14.4-150300.11.11.1
1.14.4-150300.11.11.1
skopeo
SUSE:Enterprise Storage 7.1
From an advisory covering 2 CVEs
 before 1.14.4-150300.11.11.1
1.14.4-150300.11.11.1
skopeo
openSUSE:Leap 15.5
From an advisory covering 2 CVEs
 before 1.14.4-150300.11.11.1
1.14.4-150300.11.11.1
skopeo
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 1.14.4-150300.11.11.1
1.14.4-150300.11.11.1
libgpg-error
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 1.29-150000.3.3.1
1.29-150000.3.3.1
skopeo
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 1.14.4-150000.4.26.1
1.14.4-150000.4.26.1
libgpg-error
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 1.29-150000.3.3.1
1.29-150000.3.3.1
skopeo
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 1.14.4-150000.4.26.1
1.14.4-150000.4.26.1
libgpg-error
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 1.29-150000.3.3.1
1.29-150000.3.3.1
skopeo
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 1.14.4-150000.4.26.1
1.14.4-150000.4.26.1
docker
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 8 CVEs
 before 25.0.6_ce-150000.207.1
25.0.6_ce-150000.207.1
docker
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 8 CVEs
 before 25.0.6_ce-150000.207.1
25.0.6_ce-150000.207.1
docker
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 8 CVEs
 before 25.0.6_ce-150000.207.1
25.0.6_ce-150000.207.1
docker
SUSE:Linux Enterprise Module for Containers 15 SP5
From an advisory covering 8 CVEs
 before 25.0.6_ce-150000.207.1
25.0.6_ce-150000.207.1
docker
SUSE:Linux Enterprise Module for Containers 15 SP6
From an advisory covering 8 CVEs
 before 25.0.6_ce-150000.207.1
25.0.6_ce-150000.207.1
docker
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
From an advisory covering 8 CVEs
 before 25.0.6_ce-150000.207.1
25.0.6_ce-150000.207.1
buildah
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
From an advisory covering 8 CVEs
 before 1.35.4-150300.8.25.1
1.35.4-150300.8.25.1
docker
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
From an advisory covering 8 CVEs
 before 25.0.6_ce-150000.207.1
25.0.6_ce-150000.207.1
docker
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 8 CVEs
 before 25.0.6_ce-150000.207.1
25.0.6_ce-150000.207.1
docker
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 8 CVEs
 before 25.0.6_ce-150000.207.1
25.0.6_ce-150000.207.1
docker
SUSE:Linux Enterprise Server 15 SP2-LTSS
From an advisory covering 8 CVEs
 before 25.0.6_ce-150000.207.1
25.0.6_ce-150000.207.1
buildah
SUSE:Linux Enterprise Server 15 SP3-LTSS
From an advisory covering 8 CVEs
 before 1.35.4-150300.8.25.1
1.35.4-150300.8.25.1
docker
SUSE:Linux Enterprise Server 15 SP3-LTSS
From an advisory covering 8 CVEs
 before 25.0.6_ce-150000.207.1
25.0.6_ce-150000.207.1
docker
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 8 CVEs
 before 25.0.6_ce-150000.207.1
25.0.6_ce-150000.207.1
docker
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
From an advisory covering 8 CVEs
 before 25.0.6_ce-150000.207.1
25.0.6_ce-150000.207.1
buildah
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
From an advisory covering 8 CVEs
 before 1.35.4-150300.8.25.1
1.35.4-150300.8.25.1
docker
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
From an advisory covering 8 CVEs
 before 25.0.6_ce-150000.207.1
25.0.6_ce-150000.207.1
docker
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 8 CVEs
 before 25.0.6_ce-150000.207.1
25.0.6_ce-150000.207.1
docker
SUSE:Linux Enterprise Micro 5.1
From an advisory covering 8 CVEs
 before 25.0.6_ce-150000.207.1
25.0.6_ce-150000.207.1
docker
SUSE:Linux Enterprise Micro 5.2
From an advisory covering 8 CVEs
 before 25.0.6_ce-150000.207.1
25.0.6_ce-150000.207.1
buildah
SUSE:Enterprise Storage 7.1
From an advisory covering 8 CVEs
 before 1.35.4-150300.8.25.1
1.35.4-150300.8.25.1
docker
SUSE:Enterprise Storage 7.1
From an advisory covering 8 CVEs
 before 25.0.6_ce-150000.207.1
25.0.6_ce-150000.207.1
docker
openSUSE:Leap Micro 5.5
From an advisory covering 8 CVEs
 before 25.0.6_ce-150000.207.1
25.0.6_ce-150000.207.1
docker
openSUSE:Leap 15.5
From an advisory covering 8 CVEs
 before 25.0.6_ce-150000.207.1
25.0.6_ce-150000.207.1
docker
openSUSE:Leap 15.6
From an advisory covering 8 CVEs
 before 25.0.6_ce-150000.207.1
25.0.6_ce-150000.207.1
buildah
SUSE:Linux Enterprise Module for Containers 15 SP5
From an advisory covering 4 CVEs
 before 1.35.4-150500.3.10.1
1.35.4-150500.3.10.1
buildah
SUSE:Linux Enterprise Module for Containers 15 SP6
From an advisory covering 4 CVEs
 before 1.35.4-150500.3.10.1
1.35.4-150500.3.10.1
buildah
openSUSE:Leap 15.5
From an advisory covering 4 CVEs
 before 1.35.4-150500.3.10.1
1.35.4-150500.3.10.1
buildah
openSUSE:Leap 15.6
From an advisory covering 4 CVEs
 before 1.35.4-150500.3.10.1
1.35.4-150500.3.10.1
buildah
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 4 CVEs
 before 1.35.4-150400.3.30.1
1.35.4-150400.3.30.1
buildah
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 4 CVEs
 before 1.35.4-150400.3.30.1
1.35.4-150400.3.30.1
buildah
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 4 CVEs
 before 1.35.4-150400.3.30.1
1.35.4-150400.3.30.1
buildah
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 4 CVEs
 before 1.35.4-150400.3.30.1
1.35.4-150400.3.30.1
apptainer
SUSE:Linux Enterprise Module for HPC 15 SP6
 before 1.3.6-150600.4.3.1
1.3.6-150600.4.3.1
apptainer
openSUSE:Leap 15.6
 before 1.3.6-150600.4.3.1
1.3.6-150600.4.3.1
grafana
SUSE:Manager Client Tools 12
From an advisory covering 4 CVEs
 before 10.4.15-1.71.1
10.4.15-1.71.1
grafana
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 4 CVEs
 before 10.4.15-150200.3.64.1
10.4.15-150200.3.64.1
grafana
openSUSE:Leap 15.6
From an advisory covering 4 CVEs
 before 10.4.15-150200.3.64.1
10.4.15-150200.3.64.1
grafana
SUSE:Manager Client Tools 15
From an advisory covering 4 CVEs
 before 10.4.15-150000.1.71.1
10.4.15-150000.1.71.1
skopeo
SUSE:Linux Micro 6.0
From an advisory covering 2 CVEs
 before 1.14.4-1.1
1.14.4-1.1
cmctl
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.14.5-1.1
1.14.5-1.1
buildah
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.35.4-1.1
1.35.4-1.1
apptainer
openSUSE:Tumbleweed
 before 1.3.6-2.1
1.3.6-2.1
velociraptor
openSUSE:Tumbleweed
From an advisory covering 27 CVEs
 before 0.7.0.4.git142.862ef23-1.1
0.7.0.4.git142.862ef23-1.1
traefik2
openSUSE:Tumbleweed
From an advisory covering 9 CVEs
 before 2.11.26-1.1
2.11.26-1.1
traefik
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 3.5.1-1.1
3.5.1-1.1
containerized-data-importer
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 1.64.0-160000.1.1
1.64.0-160000.1.1

History

History
RecordedChangedSources
affected
factsOSV
affected, aliases, referencesOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-28180 is a medium vulnerability (CVSS 4.3) in Fedoraproject Fedora, published March 7, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.96%, the 80th percentile. Fixed in github.com/go-jose/go-jose/v4 4.0.1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 509 package rows and 124 references. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 42 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open