{"id":"CVE-2024-28176","aliases":["ALSA-2024:3826","ALSA-2024:3827","ALSA-2024:3968","ALSA-2024:5294","ALSA-2024:9181","CLSA-2026-1792163458","EUVD-2024-0938","GHSA-hhhv-q57g-882q","MGASA-2024-0343","OESA-2025-1075","OESA-2025-1076","RHSA-2024:0045","RHSA-2024:3826","RHSA-2024:3827","RHSA-2024:3968","RHSA-2024:5294","RHSA-2024:9181","RLSA-2024:3826","RLSA-2024:3827","RLSA-2024:3968","RLSA-2024:5294","RLSA-2024:9181","UBUNTU-CVE-2024-28176"],"status":"published","title":"jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext","description":"jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has \n been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.02102,"percentile":0.81875,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2024-03-07T17:40:57Z","modified":"2026-10-29T11:31:45Z","fixes":[{"ecosystem":"npm","package":"jose","fixed_in":["4.15.5","2.0.7"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"jose-node-cjs-runtime","fixed_in":["4.15.5"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"jose-node-esm-runtime","fixed_in":["4.15.5"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"jose","fixed_in":["2.0.6-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"last_affected":"4.15.4"},{"fixed":"4.15.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"jose-node-cjs-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.15.4"},{"fixed":"4.15.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"jose-node-esm-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.15.4"},{"fixed":"4.15.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-4.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-4.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-4.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-4.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-4.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.7-2.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.7-2.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"aardvark-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.10.0-1.module_el8.10.0+3792+03eaed9c"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"aardvark-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.10.0-1.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.7-2.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.7-2.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"84.1-1.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"conmon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.10-1.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"conmon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.10-1.module_el8.10.0+3845+87b84552"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"container-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.229.0-2.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"containernetworking-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.0-2.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"containernetworking-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.0-2.module_el8.10.0+3792+03eaed9c"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1-81.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1-81.module_el8.10.0+3792+03eaed9c"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"crit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-5.module_el8.10.0+3845+87b84552"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"crit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-5.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-5.module_el8.10.0+3845+87b84552"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-5.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-5.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-5.module_el8.10.0+3845+87b84552"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.3-2.module_el8.10.0+3845+87b84552"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.3-2.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13-1.module_el8.10.0+3792+03eaed9c"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-2.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-2.module_el8.10.0+3845+87b84552"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libslirp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-2.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libslirp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-2.module_el8.10.0+3845+87b84552"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"netavark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.10.3-1.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"netavark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.10.3-1.module_el8.10.0+3845+87b84552"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"oci-seccomp-bpf-hook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10-1.module_el8.10.0+3792+03eaed9c"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-3.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-catatonit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-3.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-3.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-3.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-3.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-3.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-3.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-5.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-5.module_el8.10.0+3845+87b84552"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0-1.module_el8.10.0+3792+03eaed9c"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.12-1.module_el8.10.0+3845+87b84552"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.12-1.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.3-2.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.3-2.module_el8.10.0+3845+87b84552"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.3-2.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.3-2.module_el8.10.0+3845+87b84552"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"slirp4netns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-1.module_el8.10.0+3845+87b84552"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"slirp4netns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-1.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"toolbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.99.5-2.module_el8.10.0+3845+87b84552"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"toolbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.99.5-2.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"toolbox-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.99.5-2.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"toolbox-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.99.5-2.module_el8.10.0+3845+87b84552"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"udica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.6-21.module_el8.10.0+3858+6ad51f9f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.6-tuxcare.0"},{"fixed":"2.0.6-tuxcare.1"}]}],"versions":["2.0.6"]},{"source":"osv","ecosystem":"npm","package":"jose","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"4.15.5"}]}]},{"source":"osv","ecosystem":"npm","package":"jose-node-cjs-runtime","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.15.5"}]}]},{"source":"osv","ecosystem":"npm","package":"jose-node-esm-runtime","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.15.5"}]}]},{"source":"osv","ecosystem":"npm","package":"jose","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.7"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.37.4-1.mga9"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:9","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5-1.mga9"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:9","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-1.mga9"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4-14.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4-14.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.16::el9","package":"python-eventlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.33.1-6.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift_ironic:4.16::el9","package":"python3-eventlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.33.1-6.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"openshift-kube-apiserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"openshift-kube-controller-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"openshift-kube-scheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"openshift-kubelet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"ose-azure-acr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202404301345.p0.g0e95532.assembly.stream.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"openshift-kube-apiserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"openshift-kube-controller-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"openshift-kube-scheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"openshift-kubelet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202406170957.p0.g29c95f3.assembly.stream.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"ose-azure-acr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202404301345.p0.g0e95532.assembly.stream.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"butane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.0-1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"butane-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.0-1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"butane-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.0-1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"butane-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.0-1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.5-5.rhaos4.16.git7032128.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.5-5.rhaos4.16.git7032128.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.5-5.rhaos4.16.git7032128.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"cri-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.0-3.1.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"cri-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.0-3.1.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"cri-tools-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.0-3.1.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"ose-aws-ecr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202405311136.p0.ga53e9de.assembly.stream.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"ose-gcp-gcr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202404181812.p0.g26b43df.assembly.stream.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-catatonit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-catatonit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-gvproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.5-5.rhaos4.16.git7032128.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.5-5.rhaos4.16.git7032128.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.5-5.rhaos4.16.git7032128.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"cri-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.0-3.1.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"cri-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.0-3.1.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"cri-tools-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29.0-3.1.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"golang-github-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-15.2.gitd5383c5.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"openshift-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-15.2.gitd5383c5.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"ose-aws-ecr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202405311136.p0.ga53e9de.assembly.stream.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"ose-gcp-gcr-image-credential-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0-202404181812.p0.g26b43df.assembly.stream.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-5.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.4-1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.4-1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.4-1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"skopeo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.4-1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"skopeo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.4-1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.4-1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:1.1.12-3.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"runc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:1.1.12-3.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el8","package":"runc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:1.1.12-3.1.rhaos4.16.el8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:1.1.12-3.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"runc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:1.1.12-3.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"runc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:1.1.12-3.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"ignition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.18.0-2.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"ignition-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.18.0-2.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"ignition-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.18.0-2.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"ignition-validate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.18.0-2.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:openshift:4.16::el9","package":"ignition-validate-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.18.0-2.1.rhaos4.16.el9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-4.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-4.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-4.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-4.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-4.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-4.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-4.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-4.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-4.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.7-2.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.7-2.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.7-2.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.7-2.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.7-2.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aardvark-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.10.0-1.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.7-2.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.7-2.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.7-2.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.7-2.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.7-2.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:84.1-1.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"conmon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.10-1.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"conmon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.10-1.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"conmon-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.10-1.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"container-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.229.0-2.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containernetworking-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.0-2.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containernetworking-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.0-2.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containernetworking-plugins-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.0-2.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1-81.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"crit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-5.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-5.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"criu-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-5.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"criu-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-5.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"criu-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-5.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"criu-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-5.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"criu-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-5.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.3-2.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"crun-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.3-2.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"crun-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.3-2.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13-1.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fuse-overlayfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13-1.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fuse-overlayfs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13-1.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-2.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libslirp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-2.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libslirp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-2.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libslirp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-2.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"netavark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.10.3-1.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oci-seccomp-bpf-hook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.10-1.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oci-seccomp-bpf-hook-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.10-1.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oci-seccomp-bpf-hook-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.10-1.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-3.module+el8.10.0+21974+acd2159c"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-catatonit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-3.module+el8.10.0+21974+acd2159c"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-catatonit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-3.module+el8.10.0+21974+acd2159c"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-3.module+el8.10.0+21974+acd2159c"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-3.module+el8.10.0+21974+acd2159c"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-3.module+el8.10.0+21974+acd2159c"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-3.module+el8.10.0+21974+acd2159c"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-gvproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-3.module+el8.10.0+21974+acd2159c"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-3.module+el8.10.0+21974+acd2159c"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-3.module+el8.10.0+21974+acd2159c"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-3.module+el8.10.0+21974+acd2159c"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-3.module+el8.10.0+21974+acd2159c"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-3.module+el8.10.0+21974+acd2159c"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.0-1.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-5.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.0-1.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.12-1.module+el8.10.0+21974+acd2159c"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"runc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.12-1.module+el8.10.0+21974+acd2159c"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"runc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.12-1.module+el8.10.0+21974+acd2159c"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.3-2.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.3-2.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"slirp4netns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-1.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"slirp4netns-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-1.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"slirp4netns-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-1.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"toolbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.99.5-2.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"toolbox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.99.5-2.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"toolbox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.99.5-2.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"toolbox-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.99.5-2.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"udica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.6-21.module+el8.10.0+21962+8143777b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jose-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"jose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"jose-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libjose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"jose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"jose-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libjose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-4.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.7-2.el9_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"aardvark-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.10.0-1.module+el8.10.0+1815+5fe7415e"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.33.7-2.module+el8.10.0+1829+9bb2696f"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:84.1-1.module+el8.10.0+1815+5fe7415e"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"conmon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.10-1.module+el8.10.0+1815+5fe7415e"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"containernetworking-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.0-2.module+el8.10.0+1815+5fe7415e"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1-81.module+el8.10.0+1815+5fe7415e"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"container-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.229.0-2.module+el8.10.0+1815+5fe7415e"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18-5.module+el8.10.0+1815+5fe7415e"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14.3-2.module+el8.10.0+1815+5fe7415e"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13-1.module+el8.10.0+1815+5fe7415e"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-2.module+el8.10.0+1815+5fe7415e"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"netavark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.10.3-1.module+el8.10.0+1815+5fe7415e"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"oci-seccomp-bpf-hook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.10-1.module+el8.10.0+1815+5fe7415e"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.4-3.module+el8.10.0+1829+9bb2696f"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.14.3-2.module+el8.10.0+1815+5fe7415e"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"python-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.0-1.module+el8.10.0+1815+5fe7415e"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.12-1.module+el8.10.0+1815+5fe7415e"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"slirp4netns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-1.module+el8.10.0+1815+5fe7415e"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"toolbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"udica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.6-21.module+el8.10.0+1815+5fe7415e"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10-2.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14-1.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.7+ds-1","4.4.0+ds-1","4.5.0+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.11.4-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.11.4-1"]}],"products":[{"vendor":"appsup-dart","product":"jose"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"jose_project","product":"jose"},{"vendor":"panva","product":"jose"}],"references":[{"url":"https://github.com/panva/jose/security/advisories/GHSA-hhhv-q57g-882q","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/panva/jose/commit/02a65794f7873cdaf12e81e80ad076fcdc4a9314","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/panva/jose/commit/1b91d88d2f8233f3477a5f4579aa5f8057b2ee8b","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJDO5VSIAOGT2WP63AXAAWNRSVJCNCRH/","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KXKGNCRU7OTM5AHC7YIYBNOWI742PRMY/","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG/","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJO2U5ACZVACNQXJ5EBRFLFW6DP5BROY/","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UG5FSEYJ3GP27FZXC5YAAMMEC5XWKJHG/","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28176","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJDO5VSIAOGT2WP63AXAAWNRSVJCNCRH","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KXKGNCRU7OTM5AHC7YIYBNOWI742PRMY","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJO2U5ACZVACNQXJ5EBRFLFW6DP5BROY","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UG5FSEYJ3GP27FZXC5YAAMMEC5XWKJHG","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hhhv-q57g-882q"},{"url":"https://access.redhat.com/errata/RHSA-2024:3826","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45290","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-28176","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-28180","tags":["report"]},{"url":"https://bugzilla.redhat.com/2268017","tags":["report"]},{"url":"https://bugzilla.redhat.com/2268820","tags":["report"]},{"url":"https://bugzilla.redhat.com/2268854","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-3826.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3827","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-3827.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3968","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-3968.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:5294","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-50967","tags":["report"]},{"url":"https://bugzilla.redhat.com/2270538","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-5294.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9181","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-9181.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28176.json","tags":["advisory"]},{"url":"https://github.com/panva/jose","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2024-0343.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33036","tags":["report"]},{"url":"https://github.com/containers/buildah/security/advisories/GHSA-pmf3-c36m-g5cf","tags":["advisory"]},{"url":"https://github.com/containers/podman/security/advisories/GHSA-874v-pj72-92f3","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CYT3D2P3OJKISNFKOOHGY6HCUCQZYAVR/","tags":["web"]},{"url":"https://lwn.net/Articles/978101/","tags":["web"]},{"url":"https://lwn.net/Articles/978102/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2024-July/018858.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/PJ4RBOYLRKSRUVS77S4OAZ7SQJWH36K2/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/MYMA7BZJZTURAPGKHV2ACU3HBJTKVYMK/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1075","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24785","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1076","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0045","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2262921","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268017","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268018","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268021","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268022","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268046","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2274520","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2274767","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0045.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29483","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29483","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29483","tags":["advisory"]},{"url":"https://www.dnspython.org/news/2.6.0rc1/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45289","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45289","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45289","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45290","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45290","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/08/4","tags":["article"]},{"url":"https://go.dev/cl/569341","tags":["article"]},{"url":"https://go.dev/issue/65383","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2599","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240329-0004","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-3727","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-3727","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3727","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24783","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24783","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24783","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3q2c-pvp5-3cqp","tags":["advisory"]},{"url":"https://go.dev/cl/569339","tags":["article"]},{"url":"https://go.dev/issue/65390","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2598","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240329-0005","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24784","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24784","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24784","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24785","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24785","tags":["advisory"]},{"url":"https://go.dev/cl/564196","tags":["article"]},{"url":"https://go.dev/issue/65697","tags":["article"]},{"url":"https://vuln.go.dev/ID/GO-2024-2610.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24786","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24786","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24786","tags":["advisory"]},{"url":"https://go.dev/cl/569356","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2611","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-28176","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268854","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3826.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-28180","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28180","tags":["advisory"]},{"url":"https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3827.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-39988","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3968.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2270538","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5294.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-50967","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50967","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-38079","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9181.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:3826","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:3827","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:3968","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:5294","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:9181","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-28176","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-28176","title":"jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext","description":"jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has \n been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.","status":"published","published":"2024-03-09T00:43:06.93Z","modified":"2025-02-13T17:47:26.104Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:18.597034Z"}],"euvd":[{"id":"EUVD-2024-0938","description":"jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has \n been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.","status":"published","published":"2024-03-09T00:43:06Z","modified":"2025-02-13T17:47:26Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:53:31.829035Z"}],"ghsa":[{"id":"GHSA-hhhv-q57g-882q","title":"jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext","description":"A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the [support for decompressing plaintext after its decryption](https://www.rfc-editor.org/rfc/rfc7516.html#section-4.1.3). This allows an adversary to exploit specific scenarios where the compression ratio becomes exceptionally high. As a result, the length of the JWE token, which is determined by the compressed content's size, can land below application-defined limits. In such cases, other existing application level mechanisms for preventing resource exhaustion may be rendered ineffective.\n\nNote that as per [RFC 8725](https://www.rfc-editor.org/rfc/rfc8725.html#name-avoid-compression-of-encryp) compression of data SHOULD NOT be done before encryption, because such compressed data often reveals information about the plaintext. For this reason the v5.x major version of `jose` removed support for compressed payloads entirely and is therefore NOT affected by this advisory.\n\n### Impact\n\nUnder certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations.\n\n### Affected users\n\nThe impact is limited only to Node.js users utilizing the JWE decryption APIs to decrypt JWEs from untrusted sources.\n\nYou are NOT affected if any of the following applies to you\n\n- Your code uses jose version v5.x where JWE Compression is not supported anymore\n- Your code runs in an environment other than Node.js (e.g. Deno, CF Workers), which is the only runtime where JWE Compression is implemented out of the box\n- Your code does not use the JWE decryption APIs\n- Your code only accepts JWEs produced by trusted sources\n\n### Patches\n\n`v2.0.7` and `v4.15.5` releases limit the decompression routine to only allow decompressing up to 250 kB of plaintext. In v4.x it is possible to further adjust this limit via the `inflateRaw` decryption option implementation. In v2.x it is possible to further adjust this limit via the `inflateRawSyncLimit` decryption option.\n\n### Workarounds\n\nIf you cannot upgrade and do not want to support compressed JWEs you may detect and reject these tokens early by checking the token's protected header\n\n```js\nconst { zip } = jose.decodeProtectedHeader(token)\nif (zip !== undefined) {\n  throw new Error('JWE Compression is not supported')\n}\n```\n\nIf you wish to continue supporting JWEs with compressed payloads in these legacy release lines you must upgrade (v1.x and v2.x to version v2.0.7, v3.x and v4.x to version v4.15.5) and review the limits put forth by the patched releases.\n\n### For more information\nIf you have any questions or comments about this advisory please open a discussion in the project's [repository](https://github.com/panva/jose/discussions/new?category=q-a\u0026title=GHSA-hhhv-q57g-882q%20advisory%20question)","status":"published","published":"2024-03-07T17:40:57Z","modified":"2024-03-30T06:30:42Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:42.744468Z"}],"nvd":[{"id":"CVE-2024-28176","description":"jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has \n been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.","status":"published","published":"2024-03-09T01:15:07.147Z","modified":"2026-06-17T07:21:08.92Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:09:39.488031Z"}],"osv":[{"id":"CVE-2024-28176","title":"jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext","description":"jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has \n been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.","status":"published","published":"2024-03-09T00:43:06.93Z","modified":"2026-10-28T02:30:43.930448532Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:39.569658Z"},{"id":"GHSA-hhhv-q57g-882q","title":"jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext","description":"A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the [support for decompressing plaintext after its decryption](https://www.rfc-editor.org/rfc/rfc7516.html#section-4.1.3). This allows an adversary to exploit specific scenarios where the compression ratio becomes exceptionally high. As a result, the length of the JWE token, which is determined by the compressed content's size, can land below application-defined limits. In such cases, other existing application level mechanisms for preventing resource exhaustion may be rendered ineffective.\n\nNote that as per [RFC 8725](https://www.rfc-editor.org/rfc/rfc8725.html#name-avoid-compression-of-encryp) compression of data SHOULD NOT be done before encryption, because such compressed data often reveals information about the plaintext. For this reason the v5.x major version of `jose` removed support for compressed payloads entirely and is therefore NOT affected by this advisory.\n\n### Impact\n\nUnder certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations.\n\n### Affected users\n\nThe impact is limited only to Node.js users utilizing the JWE decryption APIs to decrypt JWEs from untrusted sources.\n\nYou are NOT affected if any of the following applies to you\n\n- Your code uses jose version v5.x where JWE Compression is not supported anymore\n- Your code runs in an environment other than Node.js (e.g. Deno, CF Workers), which is the only runtime where JWE Compression is implemented out of the box\n- Your code does not use the JWE decryption APIs\n- Your code only accepts JWEs produced by trusted sources\n\n### Patches\n\n`v2.0.7` and `v4.15.5` releases limit the decompression routine to only allow decompressing up to 250 kB of plaintext. In v4.x it is possible to further adjust this limit via the `inflateRaw` decryption option implementation. In v2.x it is possible to further adjust this limit via the `inflateRawSyncLimit` decryption option.\n\n### Workarounds\n\nIf you cannot upgrade and do not want to support compressed JWEs you may detect and reject these tokens early by checking the token's protected header\n\n```js\nconst { zip } = jose.decodeProtectedHeader(token)\nif (zip !== undefined) {\n  throw new Error('JWE Compression is not supported')\n}\n```\n\nIf you wish to continue supporting JWEs with compressed payloads in these legacy release lines you must upgrade (v1.x and v2.x to version v2.0.7, v3.x and v4.x to version v4.15.5) and review the limits put forth by the patched releases.\n\n### For more information\nIf you have any questions or comments about this advisory please open a discussion in the project's [repository](https://github.com/panva/jose/discussions/new?category=q-a\u0026title=GHSA-hhhv-q57g-882q%20advisory%20question)","status":"published","published":"2024-03-07T17:40:57Z","modified":"2026-09-10T03:50:10.493205385Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:49.28217Z"},{"id":"OESA-2025-1075","title":"podman security update","description":"Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.\r\n\r\nSecurity Fix(es):\n\nIf errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.(CVE-2024-24785)\n\njose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has \n been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user\u0026apos;s environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.(CVE-2024-28176)","status":"published","published":"2025-01-24T11:08:10Z","modified":"2026-08-18T01:17:42.895574076Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1076","title":"podman security update","description":"Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.\r\n\r\nSecurity Fix(es):\n\nIf errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.(CVE-2024-24785)\n\njose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has \n been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user\u0026apos;s environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.(CVE-2024-28176)","status":"published","published":"2025-01-24T11:08:10Z","modified":"2026-08-18T01:17:42.899505275Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"RHSA-2024:0045","title":"Red Hat Security Advisory: OpenShift Container Platform 4.16.0 security update","status":"published","published":"2024-10-02T11:03:00Z","modified":"2026-10-20T10:02:28Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:3826","title":"Red Hat Security Advisory: podman security and bug fix update","status":"published","published":"2024-10-02T11:02:19Z","modified":"2026-10-16T10:04:44Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:3827","title":"Red Hat Security Advisory: buildah security and bug fix update","status":"published","published":"2024-10-02T11:02:28Z","modified":"2026-10-16T10:04:45Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:3968","title":"Red Hat Security Advisory: container-tools:rhel8 bug fix and enhancement update","status":"published","published":"2024-10-22T14:57:17Z","modified":"2026-10-16T10:04:46Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:5294","title":"Red Hat Security Advisory: jose security update","status":"published","published":"2024-09-30T15:21:24Z","modified":"2026-10-16T10:05:07Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:9181","title":"Red Hat Security Advisory: jose security update","status":"published","published":"2024-11-13T21:18:58Z","modified":"2026-10-16T10:05:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RLSA-2024:5294","title":"Moderate: jose security update","description":"Jose is a C-language implementation of the Javascript Object Signing and Encryption standards. The jose package is a dependency of the clevis and tang packages, together providing Network Bound Disk Encryption (NBDE) in Rocky Linux.\n\nSecurity Fix(es):\n\n* jose: resource exhaustion (CVE-2024-28176)\n\n* jose: Denial of service due to uncontrolled CPU consumption (CVE-2023-50967)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-05-07T19:11:47.341314Z","modified":"2025-05-07T20:08:45.376018Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2024:9181","title":"Moderate: jose security update","description":"Jose is a C-language implementation of the Javascript Object Signing and Encryption standards. The jose package is a dependency of the clevis and tang packages, together providing Network Bound Disk Encryption (NBDE) in Rocky Linux.\n\nSecurity Fix(es):\n\n* jose: resource exhaustion (CVE-2024-28176)\n\n* jose: Denial of service due to uncontrolled CPU consumption (CVE-2023-50967)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.","status":"published","published":"2025-03-17T20:16:45.510776Z","modified":"2025-10-09T06:18:51.212975Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"UBUNTU-CVE-2024-28176","description":"jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has  been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.","status":"published","published":"2024-03-09T01:15:00Z","modified":"2026-01-20T18:37:49.40255Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"ALSA-2024:3826","title":"Moderate: podman security and bug fix update","description":"The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.\n\nSecurity Fixes:\n\n* podman: jose-go: improper handling of highly compressed data (CVE-2024-28180)\n* podman: golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)\n* podman: jose: resource exhaustion (CVE-2024-28176)","status":"published","published":"2024-06-11T00:00:00Z","modified":"2026-10-29T11:31:45.036606575Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:3827","title":"Moderate: buildah security and bug fix update","description":"The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. \n\nSecurity Fix(es):\n\n* golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)\n* jose-go: improper handling of highly compressed data (CVE-2024-28180)\n* buildah: jose: resource exhaustion (CVE-2024-28176)","status":"published","published":"2024-06-11T00:00:00Z","modified":"2026-10-29T11:31:45.84139057Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:3968","title":"Moderate: container-tools:rhel8 bug fix and enhancement update","description":"The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.\n\nSecurity Fix(es):\n\n* podman: jose-go: improper handling of highly compressed data (CVE-2024-28180)\n* buildah: jose-go: improper handling of highly compressed data (CVE-2024-28180)\n* podman: jose-go: resource exhaustion (CVE-2024-28176)\n* buildah: jose-go: resource exhaustion (CVE-2024-28176)\n* skopeo: jose-go: resource exhaustion (CVE-2024-28176)\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.","status":"published","published":"2024-06-18T00:00:00Z","modified":"2026-10-29T11:02:21.57028459Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:5294","title":"Moderate: jose security update","description":"Jose is a C-language implementation of the Javascript Object Signing and Encryption standards. The jose package is a dependency of the clevis and tang packages, together providing Network Bound Disk Encryption (NBDE) in AlmaLinux.\n\nSecurity Fix(es):\n\n* jose: resource exhaustion (CVE-2024-28176)\n* jose: Denial of service due to uncontrolled CPU consumption (CVE-2023-50967)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-08-13T00:00:00Z","modified":"2026-10-29T11:02:21.507612317Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:9181","title":"Moderate: jose security update","description":"Jose is a C-language implementation of the Javascript Object Signing and Encryption standards. The jose package is a dependency of the clevis and tang packages, together providing Network Bound Disk Encryption (NBDE) in AlmaLinux.  \n\nSecurity Fix(es):  \n\n  * jose: resource exhaustion (CVE-2024-28176)\n  * jose: Denial of service due to uncontrolled CPU consumption (CVE-2023-50967)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.\n","status":"published","published":"2024-11-12T00:00:00Z","modified":"2026-10-29T11:31:09.347125372Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"CLSA-2026-1792163458","title":"TuxCare security update for jose (1 CVE)","description":"TuxCare rebuilt jose to address 1 CVE. Fixed in 2.0.6-tuxcare.1.","status":"published","published":"2026-10-16T15:10:57Z","modified":"2026-10-16T16:31:44.829843665Z","updated_at":"2026-11-02T15:43:51.466048Z"},{"id":"MGASA-2024-0343","title":"Updated buildah, podman, skopeo packages fix security vulnerabilities","description":"A flaw was found in Buildah (and subsequently Podman Build) which allows\ncontainers to mount arbitrary locations on the host filesystem into\nbuild containers. A malicious Containerfile can use a dummy image with a\nsymbolic link to the root filesystem as a mount source and cause the\nmount operation to mount the host root filesystem inside the RUN step.\nThe commands inside the RUN step will then have read-write access to the\nhost filesystem, allowing for full container escape at build time.\n(CVE-2024-1753)\nA flaw was found in the github.com/containers/image library. This flaw\nallows attackers to trigger unexpected authenticated registry accesses\non behalf of a victim user, causing resource exhaustion, local path\ntraversal, and other attacks. (CVE-2024-3727)\nWhen parsing a multipart form (either explicitly with\nRequest.ParseMultipartForm or implicitly with Request.FormValue,\nRequest.PostFormValue, or Request.FormFile), limits on the total size of\nthe parsed form were not applied to the memory consumed while reading a\nsingle form line. This permits a maliciously crafted input containing\nvery long lines to cause allocation of arbitrarily large amounts of\nmemory, potentially leading to memory exhaustion. With fix, the\nParseMultipartForm function now correctly limits the maximum size of\nform lines. (CVE-2023-45290)\nPackage jose aims to provide an implementation of the Javascript Object\nSigning and Encryption set of standards. An attacker could send a JWE\ncontaining compressed data that used large amounts of memory and CPU\nwhen decompressed by Decrypt or DecryptMulti. Those functions now return\nan error if the decompressed data would exceed 250kB or 10x the\ncompressed size (whichever is larger). This vulnerability has been\npatched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)\njose is JavaScript module for JSON Object Signing and Encryption,\nproviding support for JSON Web Tokens (JWT), JSON Web Signature (JWS),\nJSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS),\nand more. A vulnerability has been identified in the JSON Web Encryption\n(JWE) decryption interfaces, specifically related to the support for\ndecompressing plaintext after its decryption. Under certain conditions\nit is possible to have the user's environment consume unreasonable\namount of CPU time or memory during JWE Decryption operations. This\nissue has been patched in versions 2.0.7 and 4.15.5. (CVE-2024-28176)\nA flaw was found in Go. When FIPS mode is enabled on a system, container\nruntimes may incorrectly handle certain file paths due to improper\nvalidation in the containers/common Go library. This flaw allows an\nattacker to exploit symbolic links and trick the system into mounting\nsensitive host directories inside a container. This issue also allows\nattackers to access critical host files, bypassing the intended\nisolation between containers and the host system. (CVE-2024-9341)\ngo-retryablehttp prior to 0.7.7 did not sanitize urls when writing them\nto its log file. This could lead to go-retryablehttp writing sensitive\nHTTP basic auth credentials to its log file. This vulnerability,\nCVE-2024-6104, was fixed in go-retryablehttp 0.7.7. (CVE-2024-6104)\nA vulnerability exists in the bind-propagation option of the Dockerfile\nRUN --mount instruction. The system does not properly validate the input\npassed to this option, allowing users to pass arbitrary parameters to\nthe mount instruction. This issue can be exploited to mount sensitive\ndirectories from the host into a container during the build process and,\nin some cases, modify the contents of those mounted files. Even if\nSELinux is used, this vulnerability can bypass its protection by\nallowing the source directory to be relabeled to give the container\naccess to host files. (CVE-2024-9407)\n","status":"published","published":"2024-11-01T17:26:56Z","modified":"2026-04-16T04:42:47.733556802Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"RLSA-2024:3826","title":"Moderate: podman security and bug fix update","description":"The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.\n\nSecurity Fixes:\n\n* podman: jose-go: improper handling of highly compressed data (CVE-2024-28180)\n\n* podman: golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)\n\n* podman: jose: resource exhaustion (CVE-2024-28176)","status":"published","published":"2024-06-14T14:00:40.182624Z","modified":"2026-02-05T04:30:11.861731Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2024:3827","title":"Moderate: buildah security and bug fix update","description":"The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. \n\nSecurity Fix(es):\n\n* golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)\n\n* jose-go: improper handling of highly compressed data (CVE-2024-28180)\n\n* buildah: jose: resource exhaustion (CVE-2024-28176)","status":"published","published":"2024-06-14T14:00:40.182624Z","modified":"2026-02-04T07:40:21.123853Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2024:3968","title":"Moderate: container-tools:rhel8 bug fix and enhancement update","description":"The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.\n\nSecurity Fix(es):\n\n* podman: jose-go: improper handling of highly compressed data (CVE-2024-28180)\n\n* buildah: jose-go: improper handling of highly compressed data (CVE-2024-28180)\n\n* podman: jose-go: resource exhaustion (CVE-2024-28176)\n\n* buildah: jose-go: resource exhaustion (CVE-2024-28176)\n\n* skopeo: jose-go: resource exhaustion (CVE-2024-28176)\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8 Release Notes linked from the References section.","status":"published","published":"2024-07-02T14:10:24.883859Z","modified":"2026-02-05T08:15:12.373981Z","updated_at":"2026-11-02T15:53:24.923365Z"}]}}