Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 20 Apr 2022 03:40:37 +0000
From: Zeping Bai <>
Subject: CVE-2022-29266: Apache APISIX: apisix/jwt-auth may leak secrets in
 error response 

Severity: critical


An attacker can obtain a plugin-configured secret via an error message response by sending an incorrect JSON Web Token to a route protected by the jwt-auth plugin.
The error logic in the dependency library lua-resty-jwt enables sending an RS256 token to an endpoint that requires an HS256 token, with the original secret value included in the error response.


1. Upgrade to 2.13.1 and above

2. Apply the following patch to Apache APISIX and rebuild it:
This will make this error message no longer contain sensitive information and return a fixed error message to the caller.
For the current LTS 2.13.x or master:
For the last LTS 2.10.x:

3. Manually modify the version you are using according to the commit above and rebuild it to circumvent the vulnerability.


Discovered and reported by a team from Kingdee Software (China) Ltd. consisting of Zhongyuan Tang, Hongfeng Xie, and Bing Chen.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.