diff --git a/back-port-CVE-2023-50967.patch b/back-port-CVE-2023-50967.patch deleted file mode 100644 index 64426304ec086771b2010666e9bc322a328938a9..0000000000000000000000000000000000000000 --- a/back-port-CVE-2023-50967.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 4ee7708bf6dbfaa712749f081eec1f0d122fa001 Mon Sep 17 00:00:00 2001 -From: Sergio Correia -Date: Mon, 1 Apr 2024 12:10:54 +0100 -Subject: [PATCH] Fix potential DoS issue with p2c header - -Unbounded p2c headers may be used to cause an application that accept -PBES algorithms to spend a lot of resources running PBKDF2 with a very -high number of iterations. - -Limit the maximum number of iterations to to 32768. - -Fixes: CVE-2023-50967 - -Signed-off-by: Sergio Correia - ---- - tests/cve-2023-50967/cve-2023-50967.jwe | 1 + - tests/cve-2023-50967/cve-2023-50967.jwk | 1 + - 2 files changed, 2 insertions(+) - create mode 100644 tests/cve-2023-50967/cve-2023-50967.jwe - create mode 100644 tests/cve-2023-50967/cve-2023-50967.jwk - -diff --git a/tests/cve-2023-50967/cve-2023-50967.jwe b/tests/cve-2023-50967/cve-2023-50967.jwe -new file mode 100644 -index 0000000..d157ba1 ---- /dev/null -+++ b/tests/cve-2023-50967/cve-2023-50967.jwe -@@ -0,0 +1 @@ -+{"ciphertext":"aaPb-JYGACs-loPwJkZewg","encrypted_key":"P1h8q8wLVxqYsZUuw6iEQTzgXVZHCsu8Eik-oqbE4AJGIDto3gb3SA","header":{"alg":"PBES2-HS256+A128KW","p2c":1000000000,"p2s":"qUQQWWkyyIqculSiC93mlg"},"iv":"Clg3JX9oNl_ck3sLSGrlgg","protected":"eyJlbmMiOiJBMTI4Q0JDLUhTMjU2In0","tag":"i7vga9tJkwRswFd7HlyD_A"} -\ No newline at end of file -diff --git a/tests/cve-2023-50967/cve-2023-50967.jwk b/tests/cve-2023-50967/cve-2023-50967.jwk -new file mode 100644 -index 0000000..2704e3b ---- /dev/null -+++ b/tests/cve-2023-50967/cve-2023-50967.jwk -@@ -0,0 +1 @@ -+{"alg":"PBES2-HS256+A128KW","k":"VHBLJ4-PmnqELoKbQoXuRA","key_ops":["wrapKey","unwrapKey"],"kty":"oct"} -\ No newline at end of file --- -2.40.0 - diff --git a/jose-11.tar.xz b/jose-11.tar.xz deleted file mode 100644 index df52063afe797fca30a5164cd9bee13fdfc09555..0000000000000000000000000000000000000000 Binary files a/jose-11.tar.xz and /dev/null differ diff --git a/jose-14.tar.xz b/jose-14.tar.xz new file mode 100644 index 0000000000000000000000000000000000000000..c91db12c0473ba4aef4e57b3288410b5119635ec Binary files /dev/null and b/jose-14.tar.xz differ diff --git a/jose.spec b/jose.spec index 01d768e0c263f236ef6933ea3e49eb769fabdfa9..59e971843026f07abc8e180bcf797086767f1f6f 100644 --- a/jose.spec +++ b/jose.spec @@ -1,11 +1,10 @@ Name: jose -Version: 11 -Release: 2 +Version: 14 +Release: 1 Summary: José is a command line utility for performing various tasks on JSON objects License: ASL 2.0 URL: https://github.com/latchset/%{name} Source0: https://github.com/latchset/%{name}/releases/download/v%{version}/%{name}-%{version}.tar.xz -Patch001: back-port-CVE-2023-50967.patch BuildRequires: pkgconfig, gcc, openssl-devel, zlib-devel, meson, ninja-build, asciidoc BuildRequires: jansson-devel >= 2.10 @@ -82,13 +81,18 @@ rm -rf %{buildroot}/%{_libdir}/lib%{name}.la %changelog +* Wed Jul 24 2024 dillon chen - 14-1 +- Type:enhancement +- ID:NA +- SUG:NA +- DESC: update version to 14 + * Sun Apr 7 2024 licihua - 11-2 - Type:bugfix - ID:NA - SUG:NA - DESC: fix CVE-2023-50967 - * Mon Aug 9 2021 zoulin - 11-1 - Type:enhancement - ID:NA