CVE-2025-27144: vendor: don't allow unbounded amounts of splits

In compact JWS/JWE, don't allow unbounded number of splits. Count to make sure there's the right number, then use SplitN. Fixes CVE-2025-27144 Bugs: bsc#1237681 Cherry-picked from go-jose/go-jose@99b346c Signed-off-by: Danish Prakash <contact@danishpraka.sh>
SUSE · Mar 4, 2025 · fcf9115 · fcf9115
1 parent fd39521
commit fcf9115
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/vendor/github.com/go-jose/go-jose/v4/jwe.go b/vendor/github.com/go-jose/go-jose/v4/jwe.go
diff --git a/vendor/github.com/go-jose/go-jose/v4/jws.go b/vendor/github.com/go-jose/go-jose/v4/jws.go