CVE-2024-28180

Name	CVE-2024-28180
Description	Package jose aims to provide an implementation of the Javascript Objec ...
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1065814

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang-github-go-jose-go-jose (PTS)	trixie	4.0.5-1	fixed
	forky, sid	4.1.4-1	fixed
golang-gopkg-square-go-jose.v2 (PTS)	bullseye	2.5.1-2	vulnerable
	bookworm	2.6.0-2	vulnerable
	trixie	2.6.3-3	fixed
	forky, sid	2.6.3-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
golang-github-go-jose-go-jose	source	(unstable)	4.0.1-1			1065814
golang-gopkg-square-go-jose.v2	source	(unstable)	2.6.3-1

Notes

[bookworm] - golang-gopkg-square-go-jose.v2 <no-dsa> (Minor issue)
[bullseye] - golang-gopkg-square-go-jose.v2 <no-dsa> (Minor issue)
https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g
https://github.com/go-jose/go-jose/commit/0dd4dd541c665fb292d664f77604ba694726f298 (v2.6.3)
https://github.com/go-jose/go-jose/commit/add6a284ea0f844fd6628cba637be5451fe4b28a (v3.0.3)
https://github.com/go-jose/go-jose/commit/f4c051a0653d78199a053892f7619ebf96339502 (v4.0.1)