Description (CNA)
In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt contains sensitive information.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Apache Software Foundation / Apache APISIX | affected Apache APISIX through 2.13.0 |
CWE
CWE-209
References
- https://lists.apache.org/thread/6qpfyxogbvn18g9xr8g218jjfjbfsbhr
- http://www.openwall.com/lists/oss-security/2022/04/20/1
ADP enrichment
No English description supplied.