Gnoppix Security Advisory: cjose Security Update
Gnoppix Security released GSA-6499-1 for the cjose library. The update fixes a vulnerability that could let remote attackers crash services or run arbitrary code. Upgrade immediately.
What Is Affected?
cjose is a C library for JSON Object Signing and Encryption (JOSE). It parses and validates JWT, JWS, and JWE tokens in many applications.
Vulnerability Details
A malformed JWE token triggers an invalid pointer dereference. This causes a denial of service. Memory corruption could lead to remote code execution in some environments.
Critical warning: Any service processing untrusted JOSE tokens is exposed. Patch before accepting untrusted input.
Affected Versions
- Gnoppix 24/25 (oldstable): versions before 0.6.2.2
- Gnoppix 26 (stable): versions before 0.6.2.2
- Gnoppix 27 (testing): versions before 0.6.2.3
Fixed Packages
- Gnoppix 24/25 (oldstable): upgrade to 0.6.2.2-1
- Gnoppix 26 (stable): upgrade to 0.6.2.2-1
- Gnoppix 27 (testing): upgrade to 0.6.2.3-1
Action Required
Run apt update && apt upgrade cjose, then restart all dependent services. A full restart is required for the fix to take effect.
No Workaround
There is no practical workaround. Restrict access to trusted clients until the upgrade is complete. See the Gnoppix Security tracker for package hashes. - Please update your systems.