Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade jwt-go version #113

Closed
ndobosi opened this issue Apr 28, 2021 · 1 comment · Fixed by #114
Closed

Upgrade jwt-go version #113

ndobosi opened this issue Apr 28, 2021 · 1 comment · Fixed by #114
Assignees
Labels

Comments

@ndobosi
Copy link

ndobosi commented Apr 28, 2021

golang/github.com/dgrijalva/jwt-go@3.2.0 package has a known vulnerability issue.

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service hat lacks its own audience check.

Link for more info https://ossindex.sonatype.org/vulnerability/c16fb56d-9de6-4065-9fca-d2b4cfb13020?component-type=golang&component-name=github.com%2Fdgrijalva%2Fjwt-go&utm_source=nancy-client&utm_medium=integration&utm_content=1.0.10

@ibm-devx-sdk
Copy link

🎉 This issue has been resolved in version 5.4.2 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants