important: jose/libsoup security update
important
An update for jose/libsoup is now available for NewStart CGSL MAIN 7.02.
NewStart Security has rated this update as having a security impact of important. A Common Vunlnerability Scoring System(CVSS)base score, which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.
jose:
libsoup:
Security Fix(es):
jose: A flaw was found in the Jose package, where a large number of iterations used to derive the wrapping key for the PBKDF2 algorithm may lead to a denial of service. This flaw allows an attacker to set a large number of `PBKDF2' iterations, triggering an uncontrolled resource consumption that impacts the availability of the targeted application.(CVE-2023-50967)
jose: bugfix
libsoup: A flaw was found in the libsoup library. Decoding specially crafted UTF-8 input data with the soup_header_parse_param_list_strict function can cause a heap-based buffer overflow, potentially resulting in code execution and denial of service to applications linked to the library.(CVE-2024-52531)
libsoup: bugfix
Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
http://security.gd-linux.com/how_to_apply_patch.html
Remember the build tag is 7.02.03B8.