<p>Upgrade <code>Centos:8</code> <code>containernetworking-plugins</code> to version 1:1.4.0-2.module+el8.10.0+21962+8143777b or higher.</p>

Resource Exhaustion Affecting containernetworking-plugins package, versions <1:1.4.0-2.module+el8.10.0+21962+8143777b

Threat Intelligence

0.04% (15^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-CENTOS8-CONTAINERNETWORKINGPLUGINS-7275013
published 19 Jun 2024
disclosed 9 Mar 2024

Report a new vulnerability Found a mistake?

Introduced: 9 Mar 2024

CVE-2024-28176 Open this link in a new tab CWE-400 Open this link in a new tab

How to fix?

Upgrade Centos:8 containernetworking-plugins to version 1:1.4.0-2.module+el8.10.0+21962+8143777b or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream containernetworking-plugins package and not the containernetworking-plugins package as distributed by Centos. See How to fix? for Centos:8 relevant fixed versions and status.

jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Network
Attack Complexity (AC)

Low
Privileges Required (PR)

None
User Interaction (UI)

None

Scope (S)

Unchanged

Confidentiality (C)

None
Integrity (I)

None
Availability (A)

Low