CVE-2024-21664

A null pointer dereference vulnerability was found in the jwx/jws Go module. This issue arises when invoking "jws.Parse" with a JSON serialized payload containing a present signature field while the protected field is absentm, which may cause a system crash or initiate a denial of service DOS...

CVE-2024-21664 vulnerabilities

Vulnerabilities for packages: spire-server, external-secrets-fips, minio, vexctl, mc, spire-server-fips, falcoctl, tekton-chains, kubescape, gitsign, falcoctl-fips, cosign-fips, boring-registry...

CVE-2024-21664 vulnerabilities

Vulnerabilities for packages: falcoctl, mc, spire-server, vexctl, gitsign, minio, tekton-chains, kubescape, boring-registry...

CVE-2024-21664 Parsing JSON serialized payload without protected field can lead to segfault

jwx is a Go module implementing various JWx JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE technologies. Calling jws.Parse with a JSON serialized payload where the signature field is present while protected is absent can lead to a nil pointer dereference. The vulnerability can be used to crash/DOS ...

CVE-2024-21664 Parsing JSON serialized payload without protected field can lead to segfault

jwx is a Go module implementing various JWx JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE technologies. Calling jws.Parse with a JSON serialized payload where the signature field is present while protected is absent can lead to a nil pointer dereference. The vulnerability can be used to crash/DOS ...