« Volver al listado

CVE-2024-28122

Estado: AnalizadaMedia (6.8)—

JWX is Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. This issue has been patched in versions 1.2.29 and 2.0.21.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Lestrrat-go — JWX

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-28122",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-28122",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-03-11T16:48:06.985221Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "lestrrat-go",
          "product": "jwx",
          "versions": [
            {
              "status": "affected",
              "version": ">= 2.0.0, < 2.0.21"
            },
            {
              "status": "affected",
              "version": ">= 1.2.0, < 1.2.29"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:lestrrat-go:jwx:2.0.0:*:*:*:*:*:*:*"
          ],
          "vendor": "lestrrat-go",
          "product": "jwx",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.0",
              "lessThan": "2.0.21",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:lestrrat-go:jwx:1.2.0:*:*:*:*:*:*:*"
          ],
          "vendor": "lestrrat-go",
          "product": "jwx",
          "versions": [
            {
              "status": "affected",
              "version": "1.2.0",
              "lessThan": "1.2.29",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-03-09T01:15:06.940",
  "references": [
    {
      "url": "https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/lestrrat-go/jwx/releases/tag/v1.2.29",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/lestrrat-go/jwx/releases/tag/v2.0.21",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/lestrrat-go/jwx/security/advisories/GHSA-hj3v-m684-v259",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": " JWX is Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. This vulnerability allows an attacker with a trusted public key to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. This issue has been patched in versions 1.2.29 and 2.0.21."
    },
    {
      "lang": "es",
      "value": "JWX es un módulo Go que implementa varias tecnologías JWx (JWA/JWE/JWK/JWS/JWT, también conocidas como JOSE). Esta vulnerabilidad permite a un atacante con una clave pública confiable provocar una condición de denegación de servicio (DoS) mediante la creación de un token JSON Web Encryption (JWE) malicioso con una relación de compresión excepcionalmente alta. Este problema se solucionó en las versiones 1.2.29 y 2.0.21."
    }
  ],
  "lastModified": "2026-06-17T07:21:00.713",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:lestrrat-go:jwx:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79C2CC9A-8D3D-4779-9948-92DCF7AB83FE",
              "versionEndExcluding": "1.2.29"
            },
            {
              "criteria": "cpe:2.3:a:lestrrat-go:jwx:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2F88C1FB-C158-42C7-B032-DC5B7DC21134",
              "versionEndExcluding": "2.0.21",
              "versionStartIncluding": "2.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}