CVE-2024-21664: NULL Pointer Dereference

January 9, 2024 (updated January 23, 2024)

jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. Calling jws.Parse with a JSON serialized payload where the signature field is present while protected is absent can lead to a nil pointer dereference. The vulnerability can be used to crash/DOS a system doing JWS verification.

References

github.com/advisories/GHSA-pvcr-v8j8-j5q3
github.com/lestrrat-go/jwx/commit/0e8802ce6842625845d651456493e7c87625601f
github.com/lestrrat-go/jwx/commit/d69a721931a5c48b9850a42404f18e143704adcd
github.com/lestrrat-go/jwx/security/advisories/GHSA-pvcr-v8j8-j5q3
nvd.nist.gov/vuln/detail/CVE-2024-21664

Code Behaviors & Features

Detect and mitigate CVE-2024-21664 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →