Repository navigation
chore(deps): bump jose to 1.11.13 for 8 security advisories - #7
Merged
Merged
Conversation
jose comes from ash_authentication through joken and assent; lock-only patch bump (mix.lock, no mix.exs change). - EEF-CVE-2026-65625: Attacker-controlled AES-GCM authentication tag length allows tag forgery (MEDIUM) - EEF-CVE-2026-65626: Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption (MEDIUM) - EEF-CVE-2026-65627: Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2 (MEDIUM) - EEF-CVE-2026-65628: Infinite recursion (CPU denial of service) in JOSE.JWK.shared_secret/2 on mismatched key types (MEDIUM) - EEF-CVE-2026-65629: Weak PBKDF2 parameters for password-encrypted private-key export (HIGH) - EEF-CVE-2026-65630: Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key (MEDIUM) - EEF-CVE-2026-65631: RSA JWK parsing tries to factor an attacker-controlled modulus (CPU denial of service) (MEDIUM) - EEF-CVE-2026-65632: ECDSA signature length is not validated, allowing signature malleability (MEDIUM) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
jose comes from ash_authentication, via joken 2.7.0 (
~> 1.11.12) and assent (optional). This extension's own code never calls JOSE, Joken or assent's JWT code (it only returns%{assent: Assent.Strategy.Github, code_verifier: true}), andAssent.Strategy.Githubis a plain OAuth2 strategy: GitHub returns noid_tokenand the extension sets no JWT:auth_method(client_secret_jwtorprivate_key_jwt), so a GitHub sign-in does not reach JOSE. The bump keeps the lock clean for the audit.mix hex.auditfails on master with 8 advisories in jose 1.11.12, all fixed in 1.11.13:Evidence
mix hex.auditon master →Found packages with security advisories(jose), exit 1.mix hex.auditexit 0 (No retired or security advisory packages found);MIX_ENV=test mix compile --warnings-as-errorsexit 0;mix test→ 3 passed, 0 failures.git diffis one line in mix.lock (the jose entry);mix deps.getleaves it unchanged.Merge Danger
Door: two-way
Blast Radius: lock only
Patch release of a transitive dependency; this repository's own lock (consumers resolve their own versions).
🤖 Generated with Claude Code