Improper access control in jose4j - CVE-2024-29371

Vulnerability identifier: #VU123913

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-29371

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.

jose4j
SUSE Manager Server 5.0
SUSE Manager Retail Branch Server 5.0
SUSE Manager Proxy 5.0
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Micro
SUSE Manager Client Tools for SLE Micro
SUSE Manager Client Tools for SLE
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
openSUSE Leap
Enterprise Application Runtimes
Operations Analytics - Log Analysis
Financial Transaction Manager for RedHat OpenShift
Tivoli Network Manager IP Edition
Cloud Pak for Applications
WebSphere Hybrid Edition
Storage Protect Client
Storage Protect for Virtual Environments: Data Protection for VMware
Storage Protect for Virtual Environments: Data Protection for Hyper-V
Storage Protect for Space Management
IBM OpenPages with Watson
PowerVM NovaLink
Robotic Process Automation for Cloud Pak
watsonx.data
IBM SPSS Analytic Server
IBM Tivoli System Automation Application Manager
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Sterling Partner Engagement Manager
IBM TXSeries for Multiplatforms
IBM SPSS Collaboration and Deployment Services
WebSphere Service Registry and Repository
WebSphere Remote Server
Confluence Data Center
IBM Maximo Application Suite
IBM Business Automation Workflow
IBM MQ
Siebel CRM Integration
release-notes-susemanager-proxy
release-notes-susemanager
uyuni-proxy-systemd-services
suse-manager-5.0-x86_64-server-hub-xmlrpc-api-image
suse-manager-5.0-s390x-server-hub-xmlrpc-api-image
suse-manager-5.0-ppc64le-server-hub-xmlrpc-api-image
suse-manager-5.0-aarch64-server-hub-xmlrpc-api-image
suse-manager-5.0-x86_64-server-attestation-image
suse-manager-5.0-s390x-server-attestation-image
suse-manager-5.0-ppc64le-server-attestation-image
suse-manager-5.0-aarch64-server-attestation-image
suse-manager-5.0-aarch64-proxy-tftpd-image
suse-manager-5.0-x86_64-proxy-tftpd-image
suse-manager-5.0-aarch64-proxy-ssh-image
suse-manager-5.0-x86_64-proxy-ssh-image
suse-manager-5.0-s390x-proxy-ssh-image
suse-manager-5.0-s390x-proxy-tftpd-image
suse-manager-5.0-ppc64le-proxy-tftpd-image
suse-manager-5.0-ppc64le-proxy-ssh-image
suse-manager-5.0-x86_64-proxy-squid-image
suse-manager-5.0-aarch64-proxy-squid-image
suse-manager-5.0-ppc64le-proxy-squid-image
suse-manager-5.0-s390x-proxy-squid-image
suse-manager-5.0-aarch64-server-migration-14-16-image
suse-manager-5.0-ppc64le-server-migration-14-16-image
suse-manager-5.0-s390x-server-migration-14-16-image
suse-manager-5.0-x86_64-server-migration-14-16-image
suse-manager-5.0-x86_64-proxy-httpd-image
suse-manager-5.0-ppc64le-proxy-httpd-image
suse-manager-5.0-s390x-proxy-httpd-image
suse-manager-5.0-aarch64-proxy-httpd-image
suse-manager-5.0-aarch64-proxy-salt-broker-image
suse-manager-5.0-ppc64le-proxy-salt-broker-image
suse-manager-5.0-s390x-proxy-salt-broker-image
suse-manager-5.0-x86_64-proxy-salt-broker-image
suse-manager-5.0-s390x-server-image
suse-manager-5.0-ppc64le-server-image
suse-manager-5.0-x86_64-server-image
suse-manager-5.0-aarch64-server-image
IBM CICS TX Advanced
IBM CICS TX Standard

Install updates from vendor's website.

jose4j - update to 0.9.6
Operations Analytics - Log Analysis - update to 1.3.8 Fix Pack 2
watsonx.data - update to 2.3.1
Financial Transaction Manager for RedHat OpenShift - update to 4.0.9.0
Tivoli Network Manager IP Edition - update to 4.2.0.23
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2
IBM Sterling Partner Engagement Manager - addressed in versions 6.2.3.6, 6.2.4.4
Storage Protect Client - update to 8.2.2.0
Storage Protect for Virtual Environments: Data Protection for VMware - update to 8.2.2.0
Storage Protect for Virtual Environments: Data Protection for Hyper-V - update to 8.2.2.0
Storage Protect for Space Management - update to 8.2.2.0
IBM TXSeries for Multiplatforms - update to 11.1.0.0 ifix18
Confluence Data Center - addressed in versions 9.2.19, 10.2.10
IBM Maximo Application Suite - addressed in versions 8.10.37, 8.11.34, 9.0.24, 9.1.16
PowerVM NovaLink - addressed in versions 2.1.1-260428, 2.2.1.1-260428, 2.3.2-260422
release-notes-susemanager-proxy - update to 4.3.17-150400.3.107.1
release-notes-susemanager - update to 4.3.17-150400.3.151.1
uyuni-proxy-systemd-services - update to 4.3.19-150000.1.40.2
suse-manager-5.0-x86_64-server-hub-xmlrpc-api-image - update to 5.0.7-6.30.7
suse-manager-5.0-s390x-server-hub-xmlrpc-api-image - update to 5.0.7-6.30.7
suse-manager-5.0-ppc64le-server-hub-xmlrpc-api-image - update to 5.0.7-6.30.7
suse-manager-5.0-aarch64-server-hub-xmlrpc-api-image - update to 5.0.7-6.30.7
suse-manager-5.0-x86_64-server-attestation-image - update to 5.0.7-6.34.5
suse-manager-5.0-s390x-server-attestation-image - update to 5.0.7-6.34.5
suse-manager-5.0-ppc64le-server-attestation-image - update to 5.0.7-6.34.5
suse-manager-5.0-aarch64-server-attestation-image - update to 5.0.7-6.34.5
suse-manager-5.0-aarch64-proxy-tftpd-image - update to 5.0.7-7.30.5
suse-manager-5.0-x86_64-proxy-tftpd-image - update to 5.0.7-7.30.5
suse-manager-5.0-aarch64-proxy-ssh-image - update to 5.0.7-7.30.5
suse-manager-5.0-x86_64-proxy-ssh-image - update to 5.0.7-7.30.5
suse-manager-5.0-s390x-proxy-ssh-image - update to 5.0.7-7.30.5
suse-manager-5.0-s390x-proxy-tftpd-image - update to 5.0.7-7.30.5
suse-manager-5.0-ppc64le-proxy-tftpd-image - update to 5.0.7-7.30.5
suse-manager-5.0-ppc64le-proxy-ssh-image - update to 5.0.7-7.30.5
suse-manager-5.0-x86_64-proxy-squid-image - update to 5.0.7-7.30.6
suse-manager-5.0-aarch64-proxy-squid-image - update to 5.0.7-7.30.6
suse-manager-5.0-ppc64le-proxy-squid-image - update to 5.0.7-7.30.6
suse-manager-5.0-s390x-proxy-squid-image - update to 5.0.7-7.30.6
suse-manager-5.0-aarch64-server-migration-14-16-image - update to 5.0.7-7.30.7
suse-manager-5.0-ppc64le-server-migration-14-16-image - update to 5.0.7-7.30.7
suse-manager-5.0-s390x-server-migration-14-16-image - update to 5.0.7-7.30.7
suse-manager-5.0-x86_64-server-migration-14-16-image - update to 5.0.7-7.30.7
suse-manager-5.0-x86_64-proxy-httpd-image - update to 5.0.7-7.30.13
suse-manager-5.0-ppc64le-proxy-httpd-image - update to 5.0.7-7.30.13
suse-manager-5.0-s390x-proxy-httpd-image - update to 5.0.7-7.30.13
suse-manager-5.0-aarch64-proxy-httpd-image - update to 5.0.7-7.30.13
suse-manager-5.0-aarch64-proxy-salt-broker-image - update to 5.0.7-7.32.15
suse-manager-5.0-ppc64le-proxy-salt-broker-image - update to 5.0.7-7.32.15
suse-manager-5.0-s390x-proxy-salt-broker-image - update to 5.0.7-7.32.15
suse-manager-5.0-x86_64-proxy-salt-broker-image - update to 5.0.7-7.32.15
suse-manager-5.0-s390x-server-image - update to 5.0.7-7.37.12
suse-manager-5.0-ppc64le-server-image - update to 5.0.7-7.37.12
suse-manager-5.0-x86_64-server-image - update to 5.0.7-7.37.12
suse-manager-5.0-aarch64-server-image - update to 5.0.7-7.37.12
IBM MQ - addressed in versions 9.1.0.36, 9.2.0.42, 9.3.0.40, 9.4.0.21, 9.4.5.1
IBM CICS TX Advanced - update to 10.1.0.0 ifix48
IBM CICS TX Standard - update to 11.1.0.0 ifix41
Robotic Process Automation for Cloud Pak - addressed in versions 23.0.20.6, 30.0.2

• https://bitbucket.org/b_c/jose4j/issues/220/vuln-zip-bomb-attack

• Improper access control in jose4j
• IBM Tivoli System Automation Application Manager update for jose4j
• Improper access control in IBM Buinses Automation Workflow
• Improper access control in WebSphere Service Registry and Repository
• Improper access control in IBM WebSphere Hybrid Edition
• Improper access control in IBM Enterprise Application Runtimes
• Improper access control in IBM Cloud Pak For Applications
• IBM Operations Analytics - Log Analysis update for jose4j
• SUSE update for Maintenance update for Multi-Linux Manager 5.0: Server, Proxy and Retail Branch Server
• SUSE update for Maintenance update for Multi-Linux Manager 4.3: Server, Proxy and Retail
• Improper access control in IBM WebSphere Remote Server
• IBM watsonx.data update for jose4j
• Improper access control in IBM Tivoli Network Manager IP Edition
• Multiple vulnerabilities in IBM OpenPages
• Multiple vulnerabilities in Siebel CRM Integration
• SUSE update for Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes
• IBM CICS TX Advanced update for jose4j
• IBM CICS TX Standard update for jose4j
• IBM TXSeries for Multiplatforms update for jose4j
• Multiple vulnerabilities in IBM SPSS Analytic Server
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• Confluence Data Center update for jose4j
• Multiple vulnerabilities in IBM PowerVM Novalink
• Multiple vulnerabilities in IBM Maximo Application Suite
• IBM Watson Discovery Cartridge update for jose4j
• IBM MQ update for jose4j
• Multiple vulnerabilities in IBM Financial Transaction Manager (FTM) for RedHat OpenShift
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in IBM Sterling Partner Engagement Manager
• IBM Storage Protect for Space Management update for jose4j
• IBM Storage Protect Client and Virtual Environments update for jose4j