]> git.kaiwu.me - haproxy.git/commit
projects / haproxy.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: f563e83) | patch
BUG/MINOR: jwe: only accept exact "alg" and "enc" names in JWE tokens
authorRemi Tricot-Le Breton <rlebreton@haproxy.com>
Tue, 20 Oct 2026 08:04:47 +0000 (10:04 +0200)
committerWilly Tarreau <w@1wt.eu>
Wed, 21 Oct 2026 15:43:19 +0000 (17:43 +0200)
commit6e8acfdb7572ecdd297db2ae4cc5bf99c0134665
treeb8766eebef9d153cce04924445c3578e7b66593dtree | snapshot
parentf563e836297c05f63698aa54d5a9154d0abf6b2acommit | diff
BUG/MINOR: jwe: only accept exact "alg" and "enc" names in JWE tokens

The 'alg' and 'enc' parser does not check the value length so a too
short value would still be seen as the full one ("A1" instead of
"A128CBC-HS256" for instance).

This was introduced in 3.4 by commit 416b87d5d ("MINOR: jwe: Add new
jwt_decrypt_secret converter"), so the fix must be backported to 3.4.
reg-tests/jwt/jwt_decrypt.vtc diff | blob | history
src/jwe.c diff | blob | history
haproxy upstream