CVE-2024-21664

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-21664
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-21664.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-21664
Aliases
Related
Published
2024-01-09T19:18:03.742Z
Modified
2026-04-21T04:08:57.249567Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Parsing JSON serialized payload without protected field can lead to segfault
Details

jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. Calling jws.Parse with a JSON serialized payload where the signature field is present while protected is absent can lead to a nil pointer dereference. The vulnerability can be used to crash/DOS a system doing JWS verification. This vulnerability has been patched in versions 2.0.19 and 1.2.28.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21664.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-476"
    ]
}
References

Affected packages

Git / github.com/lestrrat-go/jwx

Affected ranges

Type
GIT
Repo
https://github.com/lestrrat-go/jwx
Events
Introduced
3bb9a18ceb5f45ffc4d0b837f85a5c3eb3f0bbfe
Fixed
8c53d0ae52d5ab1e2b37c5abb67def9e7958fd65

Affected versions

v1.*
v1.0.8
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.5-rc1
v1.1.6
v1.1.7
v1.1.7-rc1
v1.1.8-rc1
v1.2.0
v1.2.1
v1.2.10
v1.2.11
v1.2.12
v1.2.13
v1.2.14
v1.2.15
v1.2.17
v1.2.18
v1.2.19
v1.2.2
v1.2.20
v1.2.21
v1.2.22
v1.2.23
v1.2.24
v1.2.25
v1.2.26
v1.2.27
v1.2.3
v1.2.4
v1.2.5
v1.2.6
v1.2.7
v1.2.8
v1.2.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-21664.json"