jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. Calling `jws.Parse` with a JSON serialized payload where the `signature` field is present while `protected` is absent can lead to a nil pointer dereference. The vulnerability can be used to crash/DOS a system doing JWS verification. This vulnerability has been patched in versions 2.0.19 and 1.2.28.
References
Configurations
History
05 Feb 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. Calling `jws.Parse` with a JSON serialized payload where the `signature` field is present while `protected` is absent can lead to a nil pointer dereference. The vulnerability can be used to crash/DOS a system doing JWS verification. This vulnerability has been patched in versions 2.0.19 and 1.2.28. | |
| References |
|
16 Jan 2024, 19:30
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Lestrrat-go jwx
Lestrrat-go |
|
| References | () https://github.com/lestrrat-go/jwx/commit/0e8802ce6842625845d651456493e7c87625601f - Patch | |
| References | () https://github.com/lestrrat-go/jwx/security/advisories/GHSA-pvcr-v8j8-j5q3 - Exploit, Vendor Advisory | |
| References | () https://github.com/lestrrat-go/jwx/commit/d69a721931a5c48b9850a42404f18e143704adcd - Patch | |
| CPE | cpe:2.3:a:lestrrat-go:jwx:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
09 Jan 2024, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-09 20:15
Updated : 2024-02-28 20:54
NVD link : CVE-2024-21664
Mitre link : CVE-2024-21664
CVE.ORG link : CVE-2024-21664
JSON object : View
Products Affected
lestrrat-go
- jwx
CWE
CWE-476
NULL Pointer Dereference