Sourced from github.com/go-jose/go-jose/v3's releases.
Version 3.0.3
Fixed
- Limit decompression output size to prevent a DoS. Backport from v4.0.1.
Version 3.0.2
Fixed
- DecryptMulti: handle decompression error (#19)
Changed
- jwe/CompactSerialize: improve performance (#67)
- Increase the default number of PBKDF2 iterations to 600k (#48)
- Return the proper algorithm for ECDSA keys (#45)
- Update golang.org/x/crypto to v0.19 (#94)
Added
- Add Thumbprint support for opaque signers (#38)
Version 3.0.1
Fixed
Security issue: an attacker specifying a large "p2c" value can cause JSONWebEncryption.Decrypt and JSONWebEncryption.DecryptMulti to consume large amounts of CPU, causing a DoS. Thanks to Matt Schwager (
@mschwager
) for the disclosure and to Tom Tervoort for originally publishing the category of attack. https://i.blackhat.com/BH-US-23/Presentations/US-23-Tervoort-Three-New-Attacks-Against-JSON-Web-Tokens.pdfThe release is tagged off the release-v3.0.1 branch to avoid mixing in some as-yet unreleased changes on the v3 branch.
Sourced from github.com/go-jose/go-jose/v3's changelog.
v3.0.3
Fixed
- Limit decompression output size to prevent a DoS. Backport from v4.0.1.
v3.0.2
Fixed
- DecryptMulti: handle decompression error (#19)
Changed
- jwe/CompactSerialize: improve performance (#67)
- Increase the default number of PBKDF2 iterations to 600k (#48)
- Return the proper algorithm for ECDSA keys (#45)
Added
- Add Thumbprint support for opaque signers (#38)
v3.0.1
Fixed
- Security issue: an attacker specifying a large "p2c" value can cause JSONWebEncryption.Decrypt and JSONWebEncryption.DecryptMulti to consume large amounts of CPU, causing a DoS. Thanks to Matt Schwager (
@mschwager
) for the disclosure and to Tom Tervoort for originally publishing the category of attack. https://i.blackhat.com/BH-US-23/Presentations/US-23-Tervoort-Three-New-Attacks-Against-JSON-Web-Tokens.pdf
add6a28
v3: backport decompression limit fix (#107)11bb4e7
doc: in v3 branch's README, point to v4 as latest (#101)863f73b
v3.0.2: Update changelog (#95)bdbc794
Update golang.org/x/crypto to v0.19 (backport) (#94)25bce79
Updated go-jose v3.0.0 to v3.0.1 in jose-util (#70)aa386df
jwe/CompactSerialize: improve performance. (#67)053c9bf
DecryptMulti: handle decompression error (#19)ca9011b
Bump go version to 1.21.4 to satisfy govulncheck (#68)c8399df
Revert pull request #10
(multiple audiences) (#24)ec819e9
Add a security.md doc for contacting us about potential security
vulnerabilit...