CVE-2024-21664

A null pointer dereference vulnerability was found in the jwx/jws Go module. This issue arises when invoking "jws.Parse" with a JSON serialized payload containing a present signature field while the protected field is absentm, which may cause a system crash or initiate a denial of service DOS...

CVE-2024-21664 vulnerabilities

Vulnerabilities for packages: mc, gitsign, minio, falcoctl, spire-server, tekton-chains, kubescape, boring-registry, vexctl...

CVE-2024-21664 vulnerabilities

Vulnerabilities for packages: falcoctl-fips, vexctl, kubescape, tekton-chains, external-secrets-fips, minio, spire-server, spire-server-fips, falcoctl, cosign-fips, gitsign, mc, boring-registry...

CVE-2024-21664 Parsing JSON serialized payload without protected field can lead to segfault

jwx is a Go module implementing various JWx JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE technologies. Calling jws.Parse with a JSON serialized payload where the signature field is present while protected is absent can lead to a nil pointer dereference. The vulnerability can be used to crash/DOS ...

CVE-2024-21664 Parsing JSON serialized payload without protected field can lead to segfault

jwx is a Go module implementing various JWx JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE technologies. Calling jws.Parse with a JSON serialized payload where the signature field is present while protected is absent can lead to a nil pointer dereference. The vulnerability can be used to crash/DOS ...