Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-38084

jose: rebase to jose-14 [rhel-10]

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Critical Critical
    • rhel-10.0.beta
    • rhel-10.0.beta, rhel-10.0
    • jose
    • None
    • jose-14-100.el10
    • None
    • None
    • Rebase
    • rhel-security-special-projects
    • ssg_security
    • 22
    • None
    • False
    • False
    • Hide

      None

      Show
      None
    • Yes
    • None
    • Rebase
    • Hide
      .`jose` provided in version 14

      The `jose` package is provided in version 14 in RHEL 10. The `jose` utility is a C-language implementation of the Javascript Object Signing and Encryption (JOSE) standards. The most important enhancements and fixes include the following:

      * Improved bound checks for the `len` function for the `oct` JWK Type in OpenSSL, as a fix to an error reported by the SAST (Static Application Security Testing) process.
      * The protected JSON Web Encryption (JWE) headers no longer contain `zip`.
      * The `jose` utility avoids potential denial of service (DoS) attacks by using high decompression chunks.
      Show
      .`jose` provided in version 14 The `jose` package is provided in version 14 in RHEL 10. The `jose` utility is a C-language implementation of the Javascript Object Signing and Encryption (JOSE) standards. The most important enhancements and fixes include the following: * Improved bound checks for the `len` function for the `oct` JWK Type in OpenSSL, as a fix to an error reported by the SAST (Static Application Security Testing) process. * The protected JSON Web Encryption (JWE) headers no longer contain `zip`. * The `jose` utility avoids potential denial of service (DoS) attacks by using high decompression chunks.
    • Done
    • None

      jose package should be updated to latest upstream stable release (jose 14)

      Upstream release that is considered latest: 14
      Current version/release in RHEL-10: 12-1.el10
      URL: https://github.com/latchset/jose

              sarroutb@redhat.com Sergio Arroutbi
              sarroutb@redhat.com Sergio Arroutbi
              Sergio Correia Sergio Correia
              SSG Security QE SSG Security QE
              Jan Fiala Jan Fiala
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: