CVE-2024-29371

Description

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.26%• Percentile: 18%

Techniques & Countermeasures

• CWE-1259•Improper Restriction of Security Token Assignment

  The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected.

Affected Systems

• chainguard•apache-pulsar

  < 4.1.2-r2

• chainguard•apache-pulsar-compat

  < 4.1.2-r2

• chainguard•confluent-common-docker

  < 7.6.9-r1

• chainguard•hadoop-fips-3.3.6

  < 3.3.6-r18 | < 3.3.6-r19

• chainguard•hadoop-fips-3.4.2

  all

• chainguard•hadoop-fips-3.5

  < 3.5.0-r4

• chainguard•kafka_exporter-strimzi-compat

  < 0.49.1-r1

• chainguard•kafka-3.7

  < 3.7.2-r50

• chainguard•kafka-3.8

  < 3.8.1-r49

• chainguard•kafka-4.0

  < 4.0.1-r2

• chainguard•kafka-iamguarded-compat-4.0

  < 4.0.1-r2

• chainguard•kafka-strimzi-compat

  < 0.49.1-r1

• chainguard•kayenta-2026.1

  < 2026.1.0-r1

• chainguard•kayenta-fips-2026.1

  < 2026.1.0-r1

• chainguard•prometheus-jmx-exporter-strimzi-compat

  < 0.49.1-r1

• chainguard•strimzi-kafka-operator

  < 0.49.1-r1

• chainguard•strimzi-kafka-operator-cluster-operator

  < 0.49.1-r1

• chainguard•strimzi-kafka-operator-kafka-agent

  < 0.49.1-r1

• chainguard•strimzi-kafka-operator-kafka-base

  < 0.49.1-r1

• chainguard•strimzi-kafka-operator-kafka-init

  < 0.49.1-r1

• chainguard•strimzi-kafka-operator-kafka-thirdparty-libs

  < 0.49.1-r1

• chainguard•strimzi-kafka-operator-kafka-thirdparty-libs-cc

  < 0.49.1-r5

• chainguard•strimzi-kafka-operator-topic-operator

  < 0.49.1-r1

• chainguard•strimzi-kafka-operator-tracing-agent

  < 0.49.1-r1

• chainguard•strimzi-kafka-operator-user-operator

  < 0.49.1-r1

• wolfi•apache-pulsar

  < 4.1.2-r2

• wolfi•apache-pulsar-compat

  < 4.1.2-r2

• wolfi•confluent-common-docker

  < 7.6.9-r1

• wolfi•kafka_exporter-strimzi-compat

  < 0.49.1-r1

• wolfi•kafka-strimzi-compat

  < 0.49.1-r1

• wolfi•prometheus-jmx-exporter-strimzi-compat

  < 0.49.1-r1

• wolfi•strimzi-kafka-operator

  < 0.49.1-r1

• wolfi•strimzi-kafka-operator-cluster-operator

  < 0.49.1-r1

• wolfi•strimzi-kafka-operator-kafka-agent

  < 0.49.1-r1

• wolfi•strimzi-kafka-operator-kafka-base

  < 0.49.1-r1

• wolfi•strimzi-kafka-operator-kafka-init

  < 0.49.1-r1

• wolfi•strimzi-kafka-operator-kafka-thirdparty-libs

  < 0.49.1-r1

• wolfi•strimzi-kafka-operator-kafka-thirdparty-libs-cc

  < 0.49.1-r5

• wolfi•strimzi-kafka-operator-topic-operator

  < 0.49.1-r1

• wolfi•strimzi-kafka-operator-tracing-agent

  < 0.49.1-r1

• wolfi•strimzi-kafka-operator-user-operator

  < 0.49.1-r1

• debian•libjose4j-java

  < 0.9.6-1 | < 0.9.6-1

• jose4j_project•jose4j

  < 0.9.5

• org.bitbucket.b_c•jose4j

  < 0.9.6

References (5)

• https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack
• https://nvd.nist.gov/vuln/detail/CVE-2024-29371
• https://bitbucket.org/b_c/jose4j/commits/19a90a64c47bb07c4aa5462f1316d5c293d81fcf
• https://bitbucket.org/b_c/jose4j/wiki/Home
• https://security-tracker.debian.org/tracker/CVE-2024-29371