idm:DL1 security update

Asianux Identity Management (IdM) is a centralized authentication, identity
management, and authorization solution for both traditional and cloud-based
enterprise environments.

Security Fix(es):

* JWCrypto: denail of service Via specifically crafted JWE (CVE-2023-6681)
* python-jwcrypto: malicious JWE token can cause denial of service
(CVE-2024-28102)

CVE-2023-50387
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and
related RFCs) allow remote attackers to cause a denial of service (CPU
consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of
the concerns is that, when there is a zone with many DNSKEY and RRSIG records,
the protocol specification implies that an algorithm must evaluate all
combinations of DNSKEY and RRSIG records.
CVE-2023-6681
A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a
denial of service (DoS) attack and possible password brute-force and dictionary
attacks to be more resource-intensive. This issue can result in a large amount
of computational consumption, causing a denial of service attack.
CVE-2024-28102
JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography.
Prior to version 1.5.6, an attacker can cause a denial of service attack by
passing in a malicious JWE Token with a high compression ratio. When the server
processes this token, it will consume a lot of memory and processing time.
Version 1.5.6 fixes this vulnerability by limiting the maximum token length.

Modularity name: "idm"
Stream name: "DL1"