Bug 2257608 (CVE-2024-21664)

Summary:	CVE-2024-21664 jwx: parsing JSON serialized payload without protected field can lead to panic
Product:	[Other] Security Response	Reporter:	TEJ RATHI <trathi>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	caswilli, dfreiber, drow, jburrell, jwendell, kaycoth, kshier, luizcosta, mkleinhe, nweather, oezr, rcernich, stcannon, sthirugn, twalsh, vkrizan, vkumar, vmugicag, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	github.com/lestrrat-go/jwx/v2/jws 2.0.19, github.com/lestrrat-go/jwx/v2/jws 1.2.28	Doc Type:	If docs needed, set a value
Doc Text:	A null pointer dereference vulnerability was found in the jwx/jws Go module. This issue arises when invoking "jws.Parse" with a JSON serialized payload containing a present signature field while the protected field is absentm, which may cause a system crash or initiate a denial of service (DOS) attack during JWS verification.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2257609, 2257610, 2257611
Bug Blocks:	2257623

Description TEJ RATHI 2024-01-10 09:51:17 UTC

In JWX, Calling `jws.Parse` with a JSON serialized payload where the `signature` field is present while `protected` is absent can lead to a nil pointer dereference. The vulnerability can be used to crash/DOS a system doing JWS verification. This vulnerability has been patched in version 2.0.19.

https://github.com/lestrrat-go/jwx/commit/0e8802ce6842625845d651456493e7c87625601f
https://github.com/lestrrat-go/jwx/commit/d69a721931a5c48b9850a42404f18e143704adcd
https://github.com/lestrrat-go/jwx/security/advisories/GHSA-pvcr-v8j8-j5q3

Comment 1 TEJ RATHI 2024-01-10 09:52:01 UTC

Created golang-github-deepmap-oapi-codegen tracking bugs for this issue:

Affects: fedora-all [bug 2257611]


Created golang-github-lestrrat-jwx tracking bugs for this issue:

Affects: fedora-all [bug 2257609]


Created open-policy-agent tracking bugs for this issue:

Affects: fedora-all [bug 2257610]