{"id":"CVE-2023-51775","aliases":["CLSA-2026-1784769507","DEBIAN-CVE-2023-51775","EUVD-2024-0539","GHSA-6qvw-249j-h44c","RHSA-2024:8075","RHSA-2024:8076","RHSA-2024:8077","ROOT-APP-MAVEN-CVE-2023-51775","SUSE-SU-2024:1507-1","SUSE-SU-2024:1532-1","UBUNTU-CVE-2023-51775"],"status":"published","title":"jose4j denial of service via specifically crafted JWE","description":"The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00871,"percentile":0.59281,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2023-12-25T00:00:00Z","modified":"2026-10-26T18:02:35Z","fixes":[{"ecosystem":"Maven","package":"org.bitbucket.b_c:jose4j","fixed_in":["0.9.4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"libjose4j-java","fixed_in":["0.9.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libjose4j-java","fixed_in":["0.9.6-1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.bitbucket.b_c:jose4j","fixed_in":["0.9.4-root.io.1","0.9.4-root.io.2","0.9.4-root.io.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.bitbucket.b_c:jose4j","fixed_in":["0.9.4-aikido.2","0.9.4-aikido.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy Module 4.3","package":"mgr-daemon","fixed_in":["4.3.9-150400.3.15.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacecmd","fixed_in":["4.3.27-150400.3.36.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-backend","fixed_in":["4.3.28-150400.3.41.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-certs-tools","fixed_in":["4.3.23-150400.3.28.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-client-tools","fixed_in":["4.3.19-150400.3.27.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-web","fixed_in":["4.3.38-150400.3.42.6"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy Module 4.3","package":"uyuni-common-libs","fixed_in":["4.3.10-150400.3.18.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"cobbler","fixed_in":["3.3.3-150400.5.42.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"image-sync-formula","fixed_in":["0.1.1711646883.4a44375-150400.3.18.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"inter-server-sync","fixed_in":["0.3.3-150400.3.30.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"jose4j","fixed_in":["0.5.1-150400.3.9.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"smdba","fixed_in":["1.7.13-0.150400.4.12.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"spacecmd","fixed_in":["4.3.27-150400.3.36.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-backend","fixed_in":["4.3.28-150400.3.41.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-certs-tools","fixed_in":["4.3.23-150400.3.28.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-client-tools","fixed_in":["4.3.19-150400.3.27.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-config","fixed_in":["4.3.13-150400.3.15.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-java","fixed_in":["4.3.73-150400.3.79.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-web","fixed_in":["4.3.38-150400.3.42.6"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"subscription-matcher","fixed_in":["0.37-150400.3.22.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"supportutils-plugin-susemanager","fixed_in":["4.3.11-150400.3.21.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager","fixed_in":["4.3.35-150400.3.48.6"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-docs_en","fixed_in":["4.3-150400.9.56.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-schema","fixed_in":["4.3.25-150400.3.39.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-sls","fixed_in":["4.3.41-150400.3.47.6"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-sync-data","fixed_in":["4.3.17-150400.3.25.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"uyuni-common-libs","fixed_in":["4.3.10-150400.3.18.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.3","package":"uyuni-reportdb-schema","fixed_in":["4.3.10-150400.3.15.6"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"release-notes-susemanager-proxy","fixed_in":["4.3.12-150400.3.82.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"release-notes-susemanager","fixed_in":["4.3.12-150400.3.108.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.bitbucket.b_c:jose4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.bitbucket.b_c:jose4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.0"},{"fixed":"0.8.0-tuxcare.1"}]}],"versions":["0.8.0"],"bundled":3},{"source":"osv","ecosystem":"Debian:13","package":"libjose4j-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libjose4j-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.bitbucket.b_c:jose4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4"}]}],"versions":["0.3.6","0.3.7","0.3.8","0.3.9","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.5.7","0.5.8","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.7.0","0.7.1","0.7.10","0.7.11","0.7.12","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","0.7.8","0.7.9","0.8.0","0.9.0","0.9.1","0.9.2","0.9.3"]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-hal-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.24-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-hibernate-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.23-2.SP1_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-hibernate-validator-cdi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.23-2.SP1_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-insights-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-1.redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-ironjacamar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-ironjacamar-common-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-ironjacamar-common-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-ironjacamar-common-spi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-ironjacamar-core-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-ironjacamar-core-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-ironjacamar-deployers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-ironjacamar-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-ironjacamar-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-jboss-cert-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-1.redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-jboss-cert-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-1.redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-jboss-ejb-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.55-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-jboss-server-migration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-39.Final_redhat_00039.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-jboss-server-migration-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-39.Final_redhat_00039.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-jboss-server-migration-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-39.Final_redhat_00039.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-jbossws-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.12-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-jsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.4-1.redhat_00003.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-undertow-jastow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.15-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-wildfly-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-wildfly-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-wildfly-javadocs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-37.redhat_00015.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-hal-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.24-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-hibernate-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.23-2.SP1_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-hibernate-validator-cdi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.23-2.SP1_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-insights-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-1.redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-ironjacamar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-ironjacamar-common-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-ironjacamar-common-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-ironjacamar-common-spi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-ironjacamar-core-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-ironjacamar-core-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-ironjacamar-deployers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-ironjacamar-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-ironjacamar-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-jboss-cert-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-1.redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-jboss-ejb-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.55-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-jboss-server-migration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-39.Final_redhat_00039.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-jboss-server-migration-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-39.Final_redhat_00039.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-jboss-server-migration-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-39.Final_redhat_00039.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-jbossws-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.12-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-jsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.4-1.redhat_00003.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-undertow-jastow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.15-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-wildfly-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-wildfly-java-jdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-wildfly-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-wildfly-javadocs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-37.redhat_00015.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-hal-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.24-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-hibernate-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.23-2.SP1_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-hibernate-validator-cdi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.23-2.SP1_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-insights-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-1.redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-ironjacamar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-ironjacamar-common-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-ironjacamar-common-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-ironjacamar-common-spi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-ironjacamar-core-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-ironjacamar-core-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-ironjacamar-deployers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-ironjacamar-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-ironjacamar-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-jboss-cert-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-1.redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-jboss-ejb-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.55-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-jboss-server-migration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-39.Final_redhat_00039.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-jboss-server-migration-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-39.Final_redhat_00039.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-jboss-server-migration-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-39.Final_redhat_00039.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-jbossws-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.12-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-jsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.4-1.redhat_00003.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-undertow-jastow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.15-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-wildfly-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-wildfly-java-jdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-wildfly-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-wildfly-javadocs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-37.redhat_00015.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.bitbucket.b_c:jose4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-root.io.1"},{"fixed":"0.9.4-root.io.2"},{"fixed":"0.9.4-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.bitbucket.b_c:jose4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-aikido.2"},{"fixed":"0.9.4-aikido.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"mgr-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.9-150400.3.15.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.27-150400.3.36.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.28-150400.3.41.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.23-150400.3.28.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.19-150400.3.27.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.38-150400.3.42.6"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-150400.3.18.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-150400.5.42.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"image-sync-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1711646883.4a44375-150400.3.18.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"inter-server-sync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.3-150400.3.30.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"jose4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.1-150400.3.9.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"smdba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.13-0.150400.4.12.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.27-150400.3.36.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.28-150400.3.41.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.23-150400.3.28.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.19-150400.3.27.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.13-150400.3.15.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.73-150400.3.79.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.38-150400.3.42.6"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"subscription-matcher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.37-150400.3.22.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"supportutils-plugin-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.11-150400.3.21.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.35-150400.3.48.6"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-150400.9.56.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.25-150400.3.39.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.41-150400.3.47.6"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.17-150400.3.25.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-150400.3.18.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"uyuni-reportdb-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-150400.3.15.6"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.12-150400.3.82.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.12-150400.3.108.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libjose4j-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.7-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libjose4j-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.12-1","0.7.12-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libjose4j-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libjose4j-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libjose4j-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.6-1"]}],"products":[{"vendor":"jose4j_project","product":"jose4j"}],"references":[{"url":"https://bitbucket.org/b_c/jose4j/issues/212","tags":["x_transferred","Exploit","Issue Tracking","report","web"]},{"url":"https://security.netapp.com/advisory/ntap-20241108-0002/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51775","tags":["advisory"]},{"url":"https://bitbucket.org/b_c/jose4j/commits/1afaa1e174b3","tags":["web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20241108-0002","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6qvw-249j-h44c"},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-51775","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:8075","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108554","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127078","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266921","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278615","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2280600","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBEAP-27049","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27357","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27548","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27613","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27658","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27700","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27701","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27713","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27714","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27715","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27746","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27747","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8075.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-34169","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-34169","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34169","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-36033","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-36033","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36033","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-51775","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-51775","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-4029","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-4029","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4029","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x7g6-rwhc-g7mj","tags":["advisory"]},{"url":"https://github.com/wildfly/wildfly/pull/17914","tags":["article"]},{"url":"https://github.com/wildfly/wildfly/pull/17935","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-4068","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-4068","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4068","tags":["advisory"]},{"url":"https://devhub.checkmarx.com/cve-details/CVE-2024-4068/","tags":["article"]},{"url":"https://github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5de747e0d/lib/parse.js#L308","tags":["article"]},{"url":"https://github.com/micromatch/braces/issues/35","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:8076","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/JBEAP-27050","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8076.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:8077","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/JBEAP-27051","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8077.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241507-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1170848","tags":["report"]},{"url":"https://bugzilla.suse.com/1208572","tags":["report"]},{"url":"https://bugzilla.suse.com/1214340","tags":["report"]},{"url":"https://bugzilla.suse.com/1214387","tags":["report"]},{"url":"https://bugzilla.suse.com/1216085","tags":["report"]},{"url":"https://bugzilla.suse.com/1217204","tags":["report"]},{"url":"https://bugzilla.suse.com/1217874","tags":["report"]},{"url":"https://bugzilla.suse.com/1218764","tags":["report"]},{"url":"https://bugzilla.suse.com/1218805","tags":["report"]},{"url":"https://bugzilla.suse.com/1218931","tags":["report"]},{"url":"https://bugzilla.suse.com/1218957","tags":["report"]},{"url":"https://bugzilla.suse.com/1219061","tags":["report"]},{"url":"https://bugzilla.suse.com/1219233","tags":["report"]},{"url":"https://bugzilla.suse.com/1219634","tags":["report"]},{"url":"https://bugzilla.suse.com/1219875","tags":["report"]},{"url":"https://bugzilla.suse.com/1220101","tags":["report"]},{"url":"https://bugzilla.suse.com/1220169","tags":["report"]},{"url":"https://bugzilla.suse.com/1220194","tags":["report"]},{"url":"https://bugzilla.suse.com/1220221","tags":["report"]},{"url":"https://bugzilla.suse.com/1220376","tags":["report"]},{"url":"https://bugzilla.suse.com/1220705","tags":["report"]},{"url":"https://bugzilla.suse.com/1220726","tags":["report"]},{"url":"https://bugzilla.suse.com/1220903","tags":["report"]},{"url":"https://bugzilla.suse.com/1220980","tags":["report"]},{"url":"https://bugzilla.suse.com/1221111","tags":["report"]},{"url":"https://bugzilla.suse.com/1221182","tags":["report"]},{"url":"https://bugzilla.suse.com/1221279","tags":["report"]},{"url":"https://bugzilla.suse.com/1221465","tags":["report"]},{"url":"https://bugzilla.suse.com/1221571","tags":["report"]},{"url":"https://bugzilla.suse.com/1221784","tags":["report"]},{"url":"https://bugzilla.suse.com/1221922","tags":["report"]},{"url":"https://bugzilla.suse.com/1222110","tags":["report"]},{"url":"https://bugzilla.suse.com/1222347","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-51775","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241532-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-51775","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-51775","description":"The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.","status":"published","published":"2023-12-25T00:00:00Z","modified":"2025-11-03T21:50:19.303Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:35:17.48054Z"}],"euvd":[{"id":"EUVD-2024-0539","description":"The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.","status":"published","published":"2023-12-25T00:00:00Z","modified":"2025-11-03T21:50:19Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:49:30.775561Z"}],"ghsa":[{"id":"GHSA-6qvw-249j-h44c","title":"jose4j denial of service via specifically crafted JWE","description":"The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.","status":"published","published":"2024-02-29T03:33:14Z","modified":"2025-11-04T16:50:04Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:39:06.376137Z"}],"nvd":[{"id":"CVE-2023-51775","description":"The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.","status":"published","published":"2024-02-29T01:42:05.637Z","modified":"2026-06-17T06:41:38.387Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:09:07.077422Z"}],"osv":[{"id":"CVE-2023-51775","description":"The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.","status":"published","published":"2024-02-29T01:42:05.637Z","modified":"2026-03-14T12:23:10.349986Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:35.245372Z"},{"id":"DEBIAN-CVE-2023-51775","description":"The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.","status":"published","published":"2024-02-29T01:42:05.637Z","modified":"2026-10-26T18:02:35.788488035Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:40.586408Z"},{"id":"GHSA-6qvw-249j-h44c","title":"jose4j denial of service via specifically crafted JWE","description":"The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.","status":"published","published":"2024-02-29T03:33:14Z","modified":"2026-09-10T03:50:09.782516816Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"RHSA-2024:8075","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.19 Security update","status":"published","published":"2024-10-15T00:24:36Z","modified":"2026-10-17T10:04:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:8076","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.19 Security update","status":"published","published":"2024-10-15T00:24:06Z","modified":"2026-10-17T10:04:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:8077","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.19 Security update","status":"published","published":"2024-10-15T00:24:57Z","modified":"2026-10-17T10:04:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"UBUNTU-CVE-2023-51775","description":"The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.","status":"published","published":"2024-02-29T01:42:00Z","modified":"2026-10-17T12:57:21.825337637Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"CLSA-2026-1784769507","title":"TuxCare security update for org.bitbucket.b_c:jose4j (3 CVEs)","description":"TuxCare rebuilt org.bitbucket.b_c:jose4j to address 3 CVEs. Fixed in 0.8.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-19T19:28:22.656811011Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"ROOT-APP-MAVEN-CVE-2023-51775","title":"CVE-2023-51775 in io.root.org.bitbucket.b_c:jose4j - Patched by Root","description":"Root has patched CVE-2023-51775 in the io.root.org.bitbucket.b_c:jose4j package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-06-18T09:08:12Z","modified":"2026-06-18T13:45:25.879609755Z","updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"SUSE-SU-2024:1507-1","title":"Security update for SUSE Manager Server 4.3","description":"\nThis update fixes the following issues:\n\ncobbler:\n\n- Provide option to use pre-built GRUB bootloader\n- Prevent parallel executions of cobbler sync actions (bsc#1218764)\n\nimage-sync-formula:\n\n- Update to version 0.1.1711646883.4a44375 \n  * Add missing URL tag\n  * Update license to SPDX syntax\n\ninter-server-sync:\n\n- Version 0.3.3-1\n  * Correct primary key export for table suseproductsccrepository (bsc#1220169)\n\njose4j:\n\n- CVE-2023-51775: Fix denial of service (CPU consumption) via a large p2c\n  (aka PBES2 Count) value (bsc#1220726)\n\nsmdba:\n\n- Version 1.7.13\n  * postmaster no longer exists from \u003e=16 and it's an alias \n    for postgresql, using postgresql command\n\nspacecmd:\n\n- Version 4.3.27-0\n  * Update translation strings\n\nspacewalk-backend:\n\n- Version 4.3.28-0\n  * Strip whitespace from .deb package metadata (bsc#1214387)\n  * Fix inserting NULL into some columns during ISSv1 sync (bsc#1220980)\n  * Add support for package signature type V4 RSA/SHA512 (bsc#1221465)\n  * Unquote HTML-encoded credentials before synchronizing repositories (bsc#1217204)\n\nspacewalk-certs-tools:\n\n- Version 4.3.23-0\n  * Fix liberty bootstrapping when zypper is installed (bsc#1222347)\n  * Apply reboot method changes for transactional systems in the bootstrap script\n\nspacewalk-client-tools:\n\n- Version 4.3.19-0\n  * Update translation strings\n\nspacewalk-config:\n\n- Version 4.3.13-0\n  * Be explicit about default Apache configs being overwritten on\n    updates and point to making custom configs. (bsc#1219061)\n\nspacewalk-java:\n\n- Version 4.3.73-0\n  * New API endpoint for getRelevantErrata. It takes multiple\n    servers as argument and it returns an array of maps\n    representing the errata that can be applied to each system\n- Version 4.3.72-0\n  * Use execution module call to detect client instance flavor\n    (PAYG/BYOS) in public cloud (bsc#1218805)\n  * Update help text for the custom repo filter field (bsc#1217874)\n  * Fix issue where Salt cannot access autoinstallation files\n    (bsc#1220221)\n  * Fix issue when checking for credential duplication\n    (bsc#1218957)\n  * Fix matching epoch while creating Ubuntu erratas\n  * When an action that belongs to an action chain is unscheduled,\n    unschedule the action chain as well (bsc#1221784)\n  * Reschedule failed SSH actions caused by a connection error due\n    to a scheduled reboot\n  * Fix removal of old IPv6 addresses (bsc#1214340)\n  * Do not automatically add child channels outside of selected\n    base channel (bsc#1220101)\n  * Fix listProxies API call (bsc#1219233)\n  * Fix system.provisionSystem when called via HTTP API (bsc#1219875)\n  * Remove package sync not available message in\n    Software \u003e Packages \u003e Profile since it is no longer available\n    for supported clients (bsc#1221279)\n  * Fix login for read-only users when using HTTP API (bsc#1221111)\n  * Add one-shot action execution to recurring custom state\n    create/edit\n  * Fix a typo in 'Deploy Files' page\n  * Drop system password as identifier on SCC system registration\n    (bsc#1219634, bsc#1221182)\n  * Fix memory size extraction in virtual instances (bsc#1219634)\n  * Fix virtual systems filters (bsc#1208572)\n  * Update license to include the year 2024\n  * Add timeout for SMTP server connection (bsc#1218931)\n  * Commit Salt event removal in case of process failure (bsc#1218931)\n  * Users with API read only are only allowed to make GET requests\n  * Ignore retry suffix when getting recurring action id from\n    schedule name\n  * Sort CLM project filters by filter name\n\nspacewalk-web:\n\n- Version 4.3.38-0\n  * Upgrade json5 to 2.2.3\n  * Upgrade semver to 7.6.0\n  * Add one-shot action execution to recurring custom state\n    create/edit\n  * Fix virtual systems filters (bsc#1208572)\n  * Improve CLM Create New Filter button\n  * Bump the WebUI version to 4.3.12\n\nsubscription-matcher:\n\n- Version 0.37\n  * add missing part number (bsc#1221922)\n  * Fix penalties logging by initializing the score director\n    consistently\n- Removed wrong apache-commons-lang dependency\n- Version 0.36\n  * Fixed Log4j 2 initialization\n\nsupportutils-plugin-susemanager:\n\n- Version 4.3.11-0\n  * Add Salt and Reposync connections to minimum required DB\n    connections calculation\n\nsusemanager:\n\n- Version 4.3.35-0\n  * Add bootstrap repository definition for openSUSE Leap 15.6\n  * Add bootstrap repository definition for SUSE Linux Enterprise 15 SP6\n\nsusemanager-docs_en:\n\n- Removed Debian 10 from the list of supported clients\n- Added new workflow describing updating of clients using recurring\n  actions to Commown Workflows\n- Added documentation on adding a storage device for VMWare\n- Documented registercloudguest tools for registering public cloud \n  installation (BYOS) by adding a reference to the Public Cloud\n  Guide\n- Added information about requirements for the PostgreSQL database\n  to the Installation and Upgrade Guide (bsc#1220376)\n- Fixed the instructions for SSL Certificates (bsc#1219061)\n- Remove package sync paragraph in package-management doc since\n  it is not available for Salt clients and traditional clients are \n  no longer supported (bsc#1221279)\n- Fixed incorrect reference to SUSE Linux Enterprise Server 15 SP5\n  as base product for SUSE Manager 4.3, even in public cloud\n- Updated VM based installation for 4.3 VM image with ignition or \n  cloudinit in Installation and Upgrade Guide\n- Added reference from Hub documentation to Inter-Server\n  Synchronization in Large Deployment Guide\n- Documented Virtualization Guest and Virtualization Host Formula\n- Reformatted Supported Clients tables in Client Configuration Guide\n  and Installation and Upgrade Guide\n- Add documentation about SMTP timeout configuration\n- Documented SSH key rotation in Salt Guide (bsc#1170848)\n- Documented liberate formula in Salt Guide\n- Fixed Prepare on-demand images section in Client Configuration \n- Fixed a changed configuration parameter for salt-ssh\n- Added Pay-as-you-go on the Cloud: FAQ document\n- Updated max-connections tuning recommendation in Large Deployment\n- Added troubleshooting instructions for setting up in public cloud\n  (BYOS) to Administration Guide\n- Added section about migrating Enterprise Linux (EL) clients to\n  SUSE Liberty Linux to Client Configuration Guide\n- Added detailed information about the messages produced by\n  subscription matcher\n- Added Pay-as-you-go as supported service on Azure to the Public\n  Cloud Guide\n- Added and fixed configuration details in Troubleshooting Renaming\n  Server in Administration Guide\n\nsusemanager-schema:\n\n- Version 4.3.25-0\n  * Add update-salt to internal state table\n\nsusemanager-sls:\n\n- Version 4.3.41-0\n  * Use execution module call to detect client instance flavor\n    (PAYG/BYOS) in public cloud (bsc#1218805)\n  * Do not log dnf needs-restarting output in Salt's log (bsc#1220194)\n  * Dynamically load an SELinux policy for 'Push via SSH tunnel'\n    for SELinux enabled clients. This policy allows communication\n    over a custom SSH port\n  * Fix reboot needed detection for SUSE systems\n  * Fix SUSE Liberty Linux bootstrapping when Zypper is installed\n    (bsc#1222347)\n  * Distinguish between different SUSE versions when detecting if a\n    reboot is needed (bsc#1220903, bsc#1221571)\n  * Improve updatestack update in uptodate state\n  * Add a standalone update-salt state\n  * Add pillar check to skip reboot_if_needed state\n  * Recognize .tar.xz and .ext4 image files (bsc#1216085)\n  * Avoid issues on reactivating traditional clients as Salt managed\n  * Fix the case of missing requisites on bootstrap (bsc#1220705)\n\nsusemanager-sync-data:\n\n- Version 4.3.17-0\n  * AlmaLinux 9 PowerTools was renamed into CRB (bsc#1222110)\n\nuyuni-common-libs:\n\n- Version 4.3.10-0\n  * Add support for package signature type V4 RSA/SHA384\n  * Add support for package signature type V4 RSA/SHA512 (bsc#1221465)\n\nuyuni-reportdb-schema:\n\n- Version 4.3.10-0\n  * Provide reportdb upgrade schema path structure\n\nHow to apply this update:\n\n1. Log in as root user to the SUSE Manager Server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2024-05-06T09:46:03Z","modified":"2026-02-04T03:52:12.206946Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1532-1","title":"Security update for SUSE Manager Server 4.3","description":"\nThis update fixes the following issues:\n\nrelease-notes-susemanager:\n\n- Update to SUSE Manager 4.3.12\n  * Monitoring: Node exporter upgraded to 1.7.0\n  * Automatic migration from Salt 3000 to the Salt Bundle\n  * New update-salt recurring state\n  * uyuni-proxy-systemd-services package has been added to proxy\n    channel\n  * New Errata getRelevantErrata API endpoint\n  * CVEs fixed:\n    2023-51775\n  * Bugs mentioned:    \n    bsc#1170848, bsc#1208572, bsc#1214340, bsc#1214387, bsc#1216085\n    bsc#1217204, bsc#1217874, bsc#1218764, bsc#1218805, bsc#1218931\n    bsc#1218957, bsc#1219061, bsc#1219233, bsc#1219634, bsc#1219875\n    bsc#1220101, bsc#1220169, bsc#1220194, bsc#1220221, bsc#1220376\n    bsc#1220705, bsc#1220726, bsc#1220903, bsc#1220980, bsc#1221111\n    bsc#1221182, bsc#1221279, bsc#1221465, bsc#1221571, bsc#1221784\n    bsc#1221922, bsc#1222110, bsc#1222347\n\n","status":"published","published":"2024-05-06T09:55:29Z","modified":"2026-02-04T03:28:12.017154Z","updated_at":"2026-11-02T15:53:54.652421Z"}]}}