5b19bd6809
Update the images dependency to v0.18.0 This includes a change in the Fedora IoT remote configuration which is now installed through an RPM instead of being hard-coded in the image definitions.
443 B
443 B
v3.0.1
Fixed:
- Security issue: an attacker specifying a large "p2c" value can cause JSONWebEncryption.Decrypt and JSONWebEncryption.DecryptMulti to consume large amounts of CPU, causing a DoS. Thanks to Matt Schwager (@mschwager) for the disclosure and to Tom Tervoort for originally publishing the category of attack. https://i.blackhat.com/BH-US-23/Presentations/US-23-Tervoort-Three-New-Attacks-Against-JSON-Web-Tokens.pdf