جزئیات آسیب‌پذیری

CVE-2026-34986

Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2Red Hat Confidential Compute AttestationRed Hat Kernel Module Management Operator for Red Hat OpenshiftRed Hat Logging Subsystem for Red Hat OpenShiftRed Hat Migration Toolkit for VirtualizationRed Hat Multicluster Engine for Kubernetes

Go JOSE affect by a panic in JWE decryption

CVSS 3.1
7.5بالا

شرح رسمی (انگلیسی)

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5.

امتیازهای CVSS

امتیازنسخهمنبعبردار
7.5بالا 3.1 CVEProject cvelistV5 (CNA) (GitHub_M) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5بالا 3.1 CVEProject cvelistV5 (CNA) (redhat-SADP) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

محصولات آسیب‌پذیر

فروشندهمحصولنسخه‌هامنبع
Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 همه CVEProject cvelistV5 (CNA)
Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 همه CVEProject cvelistV5 (CNA)
Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 همه CVEProject cvelistV5 (CNA)
Red Hat Confidential Compute Attestation همه CVEProject cvelistV5 (CNA)
Red Hat Kernel Module Management Operator for Red Hat Openshift همه CVEProject cvelistV5 (CNA)
Red Hat Logging Subsystem for Red Hat OpenShift همه CVEProject cvelistV5 (CNA)
Red Hat Logging Subsystem for Red Hat OpenShift همه CVEProject cvelistV5 (CNA)
Red Hat Logging Subsystem for Red Hat OpenShift همه CVEProject cvelistV5 (CNA)
Red Hat Logging Subsystem for Red Hat OpenShift همه CVEProject cvelistV5 (CNA)
Red Hat Logging Subsystem for Red Hat OpenShift همه CVEProject cvelistV5 (CNA)
Red Hat Logging Subsystem for Red Hat OpenShift همه CVEProject cvelistV5 (CNA)
Red Hat Migration Toolkit for Virtualization همه CVEProject cvelistV5 (CNA)
Red Hat Migration Toolkit for Virtualization همه CVEProject cvelistV5 (CNA)
Red Hat Multicluster Engine for Kubernetes همه CVEProject cvelistV5 (CNA)
Red Hat Multicluster Engine for Kubernetes همه CVEProject cvelistV5 (CNA)
Red Hat Multicluster Engine for Kubernetes همه CVEProject cvelistV5 (CNA)
Red Hat Multicluster Engine for Kubernetes همه CVEProject cvelistV5 (CNA)
Red Hat Multicluster Global Hub همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Developer Tools and Services همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Developer Tools and Services همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Developer Tools and Services همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Developer Tools and Services همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Lightspeed همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Pipelines همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Pipelines همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Pipelines همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Pipelines همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Pipelines همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Pipelines همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Pipelines همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Pipelines همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Pipelines همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Serverless همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Serverless همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Serverless همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Serverless همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Serverless همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Serverless همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Serverless همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Serverless همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Serverless همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Serverless همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Serverless همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Serverless همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Serverless همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Serverless همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Serverless همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Serverless همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Service Mesh 3 همه CVEProject cvelistV5 (CNA)
Red Hat OpenShift Service Mesh 3 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Ansible Automation Platform 2 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Ansible Automation Platform 2 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Build of Podman Desktop همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Build of Podman Desktop همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Build of Podman Desktop - Tech Preview همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Build of Podman Desktop - Tech Preview همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Connectivity Link 1 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Enterprise Linux 10 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Enterprise Linux 10 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Enterprise Linux 10 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Enterprise Linux 10 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Enterprise Linux 9 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Enterprise Linux 9 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Enterprise Linux 9 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Enterprise Linux 9 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift AI (RHOAI) همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift Cluster Manager CLI همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift Container Platform 4 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift Container Platform 4 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift Container Platform 4 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift Container Platform 4 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift Container Platform 4 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift Container Platform 4 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift Container Platform 4 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift Container Platform 4 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift Container Platform 4 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift Container Platform 4 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift Container Platform 4 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift GitOps همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift GitOps همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift GitOps همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift GitOps همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat OpenShift on AWS همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Openshift Data Foundation 4 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Quay 3 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Quay 3 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Quay 3 همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Trusted Artifact Signer همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Trusted Artifact Signer همه CVEProject cvelistV5 (CNA)
Red Hat Red Hat Trusted Artifact Signer همه CVEProject cvelistV5 (CNA)
Red Hat Security Profiles Operator همه CVEProject cvelistV5 (CNA)
Red Hat Security Profiles Operator همه CVEProject cvelistV5 (CNA)
Red Hat Zero Trust Workload Identity Manager - Tech Preview همه CVEProject cvelistV5 (CNA)
Red Hat Zero Trust Workload Identity Manager - Tech Preview همه CVEProject cvelistV5 (CNA)
Red Hat Zero Trust Workload Identity Manager - Tech Preview همه CVEProject cvelistV5 (CNA)
Red Hat Zero Trust Workload Identity Manager - Tech Preview همه CVEProject cvelistV5 (CNA)
Red Hat Zero Trust Workload Identity Manager - Tech Preview همه CVEProject cvelistV5 (CNA)
Red Hat cert-manager Operator for Red Hat OpenShift همه CVEProject cvelistV5 (CNA)
Red Hat cert-manager Operator for Red Hat OpenShift همه CVEProject cvelistV5 (CNA)
Red Hat cert-manager Operator for Red Hat OpenShift همه CVEProject cvelistV5 (CNA)
Red Hat cert-manager Operator for Red Hat OpenShift همه CVEProject cvelistV5 (CNA)
Red Hat cert-manager Operator for Red Hat OpenShift همه CVEProject cvelistV5 (CNA)
go-jose go-jose < 3.0.5 CVEProject cvelistV5 (CNA)
go-jose go-jose >= 4.0.0, < 4.1.4 CVEProject cvelistV5 (CNA)

منابع و راهنماها

۱۵۰
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.

اطلاعات

تاریخ انتشار
۱۴۰۵/۰۱/۱۷
آخرین به‌روزرسانی
۱۴۰۵/۰۶/۲۷
وضعیت
منتشرشده
صادرکننده (CNA)
GitHub_M

پیش‌بینی بهره‌برداری (EPSS)

۰٫۶۶٪
احتمال بهره‌برداری در ۳۰ روز
۵۱٫۸٪
صدک (نسبت به همه‌ی CVEها)

ارزیابی SSVC (CISA)

قابل خودکارسازی
بله
وضعیت بهره‌برداری
ندارد
اثر فنی
جزئی

ضعف‌ها (CWE)

  • CWE-248
    Uncaught Exception
  • CWE-131
    Incorrect Calculation of Buffer Size