Updated cjose packages fix security vulnerabilities
Publication date: 12 Oct 2026Modification date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-53938 , CVE-2026-53939
Description
The updated packages fix security vulnerabilities:
Heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW).
(CVE-2026-53938)
All-zero Content Encryption Key used for AES-CBC-HMAC JWE encryption.
(CVE-2026-53939)
References
- https://bugs.mageia.org/show_bug.cgi?id=36320
- https://lists.debian.org/debian-security-announce/2026/msg00410.html
- https://github.com/OpenIDC/cjose/security/advisories/GHSA-75r7-f5cv-g3wj
- https://github.com/OpenIDC/cjose/security/advisories/GHSA-f6wf-pqg3-6wqq
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/2D6S3Z3ZBW3G2GOAA7DPZOCHKZ67LAUY/
- https://www.cve.org/CVERecord?id=CVE-2026-53938
- https://www.cve.org/CVERecord?id=CVE-2026-53939
SRPMS
10/core
- cjose-0.6.2.4-1.1.mga10