Github.Com Lestrrat-Go Jwx vulnerabilities

CVE-2024-21664 [MEDIUM] CWE-476 Parsing JSON serialized payload without protected field can lead to segfault Parsing JSON serialized payload without protected field can lead to segfault ### Summary Calling `jws.Parse` with a JSON serialized payload where the `signature` field is present while `protected` is absent can lead to a nil pointer dereference. ### Details This seems to also affect other functions that calls `Parse` internally, like `jws.Verify`. My understanding of these functions

CVE-2024-28122 [MEDIUM] CWE-400 JWX vulnerable to a denial of service attack using compressed JWE message JWX vulnerable to a denial of service attack using compressed JWE message ### Summary This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and p

CVE-2023-49290 [MEDIUM] CWE-400 lestrrat-go/jwx's malicious parameters in JWE can cause a DOS lestrrat-go/jwx's malicious parameters in JWE can cause a DOS ### Summary too high p2c parameter in JWE's alg PBES2-* could lead to a DOS attack ### Details The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c (PBES2 Count). This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its primary purpose is to intentionally slow d