CVE-2024-21664 Parsing JSON serialized payload without protected field can lead to segfault

What is CVE-2024-21664?

CVE-2024-21664 is a medium-severity vulnerability in lestrrat-go jwx, published on 9 Jan 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. Calling `jws.Parse` with a JSON serialized payload where the `signature` field is present while `protected` is absent can lead to a nil pointer dereference. The vulnerability can be used to crash/DOS a system doing JWS verification. This vulnerability has been patched in versions 2.0.19 and 1.2.28.

Weakness: CWE-476

Which versions are affected by CVE-2024-21664?

6 open source packages ship an affected version, including github.com/lestrrat-go/jwx and github.com/lestrrat-go/jwx/v2. It affects 1 product.

Products include Lestrrat-Go Jwx.

How do I fix CVE-2024-21664?

Upgrade github.com/lestrrat-go/jwx to 1.2.28 or later.

Is CVE-2024-21664 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-21664 exists.

Other vulnerabilities in lestrrat-go jwx

• CVE-2024-28122 JWX vulnerable to a denial of service attack using compressed JWE message Medium 6.8
• CVE-2023-49290 Malicious parameters can cause a denial of service in lestrrat-go/jwx Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pvcr-v8j8-j5q3, GO-2024-2454, MINI-3w4v-wc8m-6vpm, MINI-6c6p-2vff-7rvf, MINI-7fmq-v75f-gqm3, MINI-cgwv-cgmv-rfwv and 8 more.