CVE-2024-21664
published 2024-01-09CVE-2024-21664: jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. Calling `jws.Parse` with a JSON serialized payload…
PriorityP337high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.86%
54.5th percentile
jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. Calling `jws.Parse` with a JSON serialized payload where the `signature` field is present while `protected` is absent can lead to a nil pointer dereference. The vulnerability can be used to crash/DOS a system doing JWS verification. This vulnerability has been patched in versions 2.0.19 and 1.2.28.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | lestrrat-go_jwx | >= 1.0.8 < 1.2.28 | 1.2.28 |
| github.com | lestrrat-go_jwx_v2 | >= 0 < 2.0.19 | 2.0.19 |
| lestrrat-go | jwx | < 2.0.19 | 2.0.19 |
| lestrrat-go | jwx | — | — |
| lestrrat-go | jwx | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2
osv·2024-01-23
CVE-2024-21664 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2
GHSA
Parsing JSON serialized payload without protected field can lead to segfault
ghsa·2024-01-09
CVE-2024-21664 [MEDIUM] CWE-476 Parsing JSON serialized payload without protected field can lead to segfault
Parsing JSON serialized payload without protected field can lead to segfault
### Summary
Calling `jws.Parse` with a JSON serialized payload where the `signature` field is present while `protected` is absent can lead to a nil pointer dereference.
### Details
This seems to also affect other functions that calls `Parse` internally, like `jws.Verify`.
My understanding of these functions from the docs is that they are supposed to fail gracefully on invalid input and don't require any prior validation.
Based on the stack trace in the PoC, the issue seems to be that the processing done in `jws/message.go:UnmarshalJSON()` assumes that if a `signature` field is present, then a `protected` field is also present. If this is not the case, then the subsequent call to `getB64Value(sig.protected)`
OSV
Parsing JSON serialized payload without protected field can lead to segfault
osv·2024-01-09
CVE-2024-21664 [MEDIUM] Parsing JSON serialized payload without protected field can lead to segfault
Parsing JSON serialized payload without protected field can lead to segfault
### Summary
Calling `jws.Parse` with a JSON serialized payload where the `signature` field is present while `protected` is absent can lead to a nil pointer dereference.
### Details
This seems to also affect other functions that calls `Parse` internally, like `jws.Verify`.
My understanding of these functions from the docs is that they are supposed to fail gracefully on invalid input and don't require any prior validation.
Based on the stack trace in the PoC, the issue seems to be that the processing done in `jws/message.go:UnmarshalJSON()` assumes that if a `signature` field is present, then a `protected` field is also present. If this is not the case, then the subsequent call to `getB64Value(sig.protected)`
Red Hat
jwx: parsing JSON serialized payload without protected field can lead to panic
vendor_redhat·2024-01-09·CVSS 4.3
CVE-2024-21664 [MEDIUM] CWE-476 jwx: parsing JSON serialized payload without protected field can lead to panic
jwx: parsing JSON serialized payload without protected field can lead to panic
jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. Calling `jws.Parse` with a JSON serialized payload where the `signature` field is present while `protected` is absent can lead to a nil pointer dereference. The vulnerability can be used to crash/DOS a system doing JWS verification. This vulnerability has been patched in versions 2.0.19 and 1.2.28.
A null pointer dereference vulnerability was found in the jwx/jws Go module. This issue arises when invoking "jws.Parse" with a JSON serialized payload containing a present signature field while the protected field is absentm, which may cause a system crash or initiate a denial of service (DOS) attack during JWS
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/lestrrat-go/jwx/commit/0e8802ce6842625845d651456493e7c87625601fhttps://github.com/lestrrat-go/jwx/commit/8c53d0ae52d5ab1e2b37c5abb67def9e7958fd65https://github.com/lestrrat-go/jwx/commit/d69a721931a5c48b9850a42404f18e143704adcdhttps://github.com/lestrrat-go/jwx/security/advisories/GHSA-pvcr-v8j8-j5q3https://github.com/lestrrat-go/jwx/commit/0e8802ce6842625845d651456493e7c87625601fhttps://github.com/lestrrat-go/jwx/commit/8c53d0ae52d5ab1e2b37c5abb67def9e7958fd65https://github.com/lestrrat-go/jwx/commit/d69a721931a5c48b9850a42404f18e143704adcdhttps://github.com/lestrrat-go/jwx/security/advisories/GHSA-pvcr-v8j8-j5q3
2024-01-09
Published