CVE-2024-28122
Assigner: GitHub_M
Published: 2024-03-09T00:45:50.129Z
State: PUBLISHED
title:  JWX vulnerable to a denial of service attack using compressed JWE message
problemTypes: descriptions: cweId: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
version: 3.1
affected: vendor: lestrrat-go
product: jwx
versions: version: >= 2.0.0, < 2.0.21
status: affected
version: >= 1.2.0, < 1.2.29
status: affected
descriptions: value:  JWX is Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. This issue has been patched in versions 1.2.29 and 2.0.21.
source: advisory: GHSA-hj3v-m684-v259
discovery: UNKNOWN