CVE-2024-28122 - OpenCVE

JWX is Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. This issue has been patched in versions 1.2.29 and 2.0.21.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29
https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21
https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259
https://nvd.nist.gov/vuln/detail/CVE-2024-28122
https://www.cve.org/CVERecord?id=CVE-2024-28122

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-03-09T00:45:50.129Z

Updated: 2024-08-02T00:48:48.987Z

Reserved: 2024-03-04T14:19:14.060Z

Link: CVE-2024-28122

Vulnrichment

Updated: 2024-08-02T00:48:48.987Z

NVD

Status : Awaiting Analysis

Published: 2024-03-09T01:15:06.940

Modified: 2024-03-11T01:32:39.697

Link: CVE-2024-28122

Redhat

Severity : Moderate

Publid Date: 2024-03-09T00:00:00Z

Links: CVE-2024-28122 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-28122", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-03-04T14:19:14.060Z", "datePublished": "2024-03-09T00:45:50.129Z", "dateUpdated": "2024-08-02T00:48:48.987Z"}, "containers": {"cna": {"title": " JWX vulnerable to a denial of service attack using compressed JWE message", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259"}, {"name": "https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29", "tags": ["x_refsource_MISC"], "url": "https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29"}, {"name": "https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21", "tags": ["x_refsource_MISC"], "url": "https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21"}], "affected": [{"vendor": "lestrrat-go", "product": "jwx", "versions": [{"version": ">= 2.0.0, < 2.0.21", "status": "affected"}, {"version": ">= 1.2.0, < 1.2.29", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-09T00:45:50.129Z"}, "descriptions": [{"lang": "en", "value": " JWX is Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. This issue has been patched in versions 1.2.29 and 2.0.21."}], "source": {"advisory": "GHSA-hj3v-m684-v259", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "lestrrat-go", "product": "jwx", "cpes": ["cpe:2.3:a:lestrrat-go:jwx:2.0.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "2.0.0", "status": "affected", "lessThan": "2.0.21", "versionType": "custom"}]}, {"vendor": "lestrrat-go", "product": "jwx", "cpes": ["cpe:2.3:a:lestrrat-go:jwx:1.2.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1.2.0", "status": "affected", "lessThan": "1.2.29", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-03-11T16:48:06.985221Z", "id": "CVE-2024-28122", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-23T14:52:00.920Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:48:48.987Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259"}, {"name": "https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29"}, {"name": "https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259", "name": "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29", "name": "https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21", "name": "https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:48:48.987Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-28122", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-11T16:48:06.985221Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:lestrrat-go:jwx:2.0.0:*:*:*:*:*:*:*"], "vendor": "lestrrat-go", "product": "jwx", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "2.0.21", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:lestrrat-go:jwx:1.2.0:*:*:*:*:*:*:*"], "vendor": "lestrrat-go", "product": "jwx", "versions": [{"status": "affected", "version": "1.2.0", "lessThan": "1.2.29", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-23T14:50:35.480Z"}}], "cna": {"title": " JWX vulnerable to a denial of service attack using compressed JWE message", "source": {"advisory": "GHSA-hj3v-m684-v259", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "lestrrat-go", "product": "jwx", "versions": [{"status": "affected", "version": ">= 2.0.0, < 2.0.21"}, {"status": "affected", "version": ">= 1.2.0, < 1.2.29"}]}], "references": [{"url": "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259", "name": "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29", "name": "https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21", "name": "https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": " JWX is Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. This issue has been patched in versions 1.2.29 and 2.0.21."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-09T00:45:50.129Z"}}}, "cveMetadata": {"cveId": "CVE-2024-28122", "state": "PUBLISHED", "dateUpdated": "2024-08-02T00:48:48.987Z", "dateReserved": "2024-03-04T14:19:14.060Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-03-09T00:45:50.129Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}