CVE-2024-21664CWE-476

Parsing JSON serialized payload without protected field can lead to segfault

Medium · published January 9, 2024

CVSS v3.1
4.3
EPSS
1%
Percentile
58.2
In the wild
Unconfirmed
What it is

jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. Calling `jws.Parse` with a JSON serialized payload where the `signature` field is present while `protected` is absent can lead to a nil pointer dereference. The vulnerability can be used to crash/DOS a system doing JWS verification. This vulnerability has been patched in versions 2.0.19 and 1.2.28.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00864 · 58.2th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2024-01-09T19:18Z
EPSS history
Timeline
  • 09 JAN 19:18Z
    Parsing JSON serialized payload without protected field can lead to segfault
    cvelistv5