Unscored CVE-2022-29266 EUVD-2022-33609GHSA-x46m-gg6j-22gf

apisix/jwt-auth may leak secrets in error response

Published Apr 20, 2022 · Updated Aug 3, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache APISIX

Description

In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt contains sensitive information.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache APISIX	Apache APISIX – ≤ 2.13.0	—

References

https://lists.apache.org/thread/6qpfyxogbvn18g9xr8g218jjfjbfsbhr
[oss-security] 20220420 CVE-2022-29266: Apache APISIX: apisix/jwt-auth may leak secrets in error response mailing-list