Parsing JSON serialized payload without protected field can lead to segfault
Vulnerability Description
jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. Calling `jws.Parse` with a JSON serialized payload where the `signature` field is present while `protected` is absent can lead to a nil pointer dereference. The vulnerability can be used to crash/DOS a system doing JWS verification. This vulnerability has been patched in versions 2.0.19 and 1.2.28.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-21664
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/lestrrat-go/jwx/security/advisories/GHSA-pvcr-v8j8-j5q3
- https://github.com/lestrrat-go/jwx/commit/0e8802ce6842625845d651456493e7c87625601f
- https://github.com/lestrrat-go/jwx/commit/8c53d0ae52d5ab1e2b37c5abb67def9e7958fd65
- https://github.com/lestrrat-go/jwx/commit/d69a721931a5c48b9850a42404f18e143704adcd
Affected Vendor
lestrrat-go
View all reports →