CVE-2024-28122
published 2024-03-09CVE-2024-28122: JWX is Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. This vulnerability allows an attacker with a trusted…
PriorityP430medium6.8CVSS 3.1
AVNACLPRHUINSCCNINAH
EPSS
0.57%
43.4th percentile
JWX is Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. This issue has been patched in versions 1.2.29 and 2.0.21.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | lestrrat-go_jwx | >= 0 < 1.2.29 | 1.2.29 |
| github.com | lestrrat-go_jwx_v2 | >= 0 < 2.0.21 | 2.0.21 |
| lestrrat-go | jwx | < 1.2.29 | 1.2.29 |
| lestrrat-go | jwx | — | — |
| lestrrat-go | jwx | — | — |
| lestrrat-go | jwx | >= 2.0.0 < 2.0.21 | 2.0.21 |
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx
osv·2024-05-20
CVE-2024-28122 JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx
JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx
An attacker with a trusted public key may cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression.
GHSA
JWX vulnerable to a denial of service attack using compressed JWE message
ghsa·2024-03-08
CVE-2024-28122 [MEDIUM] CWE-400 JWX vulnerable to a denial of service attack using compressed JWE message
JWX vulnerable to a denial of service attack using compressed JWE message
### Summary
This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression.
### Details
**The attacker needs to obtain a valid public key to compress the payload**. It needs to be valid so that the recipient can use to successfully decompress the payload. Furthermore in context JWT processing in the v2 versions, the recipient must explicitly allow JWE handling .
The attacker then crafts a message with high compression ratio, e.g. a payloa
OSV
JWX vulnerable to a denial of service attack using compressed JWE message
osv·2024-03-08
CVE-2024-28122 [MEDIUM] JWX vulnerable to a denial of service attack using compressed JWE message
JWX vulnerable to a denial of service attack using compressed JWE message
### Summary
This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time during decompression.
### Details
**The attacker needs to obtain a valid public key to compress the payload**. It needs to be valid so that the recipient can use to successfully decompress the payload. Furthermore in context JWT processing in the v2 versions, the recipient must explicitly allow JWE handling .
The attacker then crafts a message with high compression ratio, e.g. a payloa
Red Hat
jwx: denial of service attack using compressed JWE message
vendor_redhat·2024-03-09·CVSS 6.8
CVE-2024-28122 [MEDIUM] CWE-400 jwx: denial of service attack using compressed JWE message
jwx: denial of service attack using compressed JWE message
JWX is Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. This issue has been patched in versions 1.2.29 and 2.0.21.
An uncontrolled resource consumption vulnerability was found in jwx. This flaw allows an attacker with a trusted public key to cause a denial of service condition by crafting a malicious JWE token with an exceptionally high compression ratio.
Package: openshift-service-mesh/istio-cni-rhel8 (OpenShift Service Mesh 2) - Not affected
Package: openshift-service-mesh
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259
2024-03-09
Published