-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a re-entrancy bug in the JWT authentication filter when handling multiple JWTs and remote JWKS fetching fails. The analysis of the security patch daefd2f7b3fc2f1c24830ba092d9ca19213b1f39 reveals the root cause. When a remote JWKS fetch fails, the onJwksError callback in AuthenticatorImpl is triggered. If another JWT is present, AuthenticatorImpl::startVerify is called again, leading to a re-entrant call to JwksFetcherImpl::fetch. The original onJwksError call chain proceeds and calls JwksFetcherImpl::reset, which, prior to the patch, would unconditionally nullify the receiver_ and request_ pointers. This action corrupts the state of the second, in-flight fetch request. When the asynchronous HTTP response for this second fetch arrives, the callback attempts to use the now-null receiver_ pointer, resulting in a null pointer dereference and a crash (DoS). The patch introduces a complete_ flag in JwksFetcherImpl to ensure that reset only clears state for completed requests and adds a call to fetcher_->cancel() in AuthenticatorImpl::startVerify to properly manage the fetcher's lifecycle during re-entrant calls.
Envoy::Extensions::HttpFilters::Common::JwksFetcherImpl::resetsource/extensions/filters/http/common/jwks_fetcher.cc
Envoy::Extensions::HttpFilters::JwtAuthn::AuthenticatorImpl::startVerifysource/extensions/filters/http/jwt_authn/authenticator.cc
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/envoyproxy/envoy | go | >= 1.36.0, <= 1.36.2 | 1.36.3 |
| github.com/envoyproxy/envoy | go | >= 1.35.0, <= 1.35.6 | 1.35.7 |
| github.com/envoyproxy/envoy | go | >= 1.34.0, <= 1.34.10 | 1.34.11 |
| github.com/envoyproxy/envoy | go | <= 1.33.12 | 1.33.13 |