GO-2024-2454 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2

Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2...

CVE-2023-49290

lestrrat-go/jwx is a Go module implementing various JWx JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE technologies. A p2c parameter set too high in JWE's algorithm PBES2- could lead to a denial of service. The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c...

GO-2023-1859 Padding oracle vulnerability in github.com/lestrrat-go/jwx

AES-CBC decryption is vulnerable to a timing attack which may permit an attacker to recover the plaintext of JWE data...