search

go-kit / kit

A standard library for microservices.
https://gokit.io
MIT License
26.35k stars 2.42k forks source link

nats-io/jwt/v2 & nats-io/nats-server/v2 vulnerability issues CVE-2021-3127 & CVE-2022-24450 #1236

Closed denopink closed 1 year ago

denopink commented 2 years ago

What did you do?

Run dependency check in a project with go-kit 0.12.0 for known vulnerabilities.

What did you expect?

Run dependency check with go-kit without vulnerabilities medium or higher.

What happened instead?

Current version of https://github.com/nats-io/jwt/v2 (v2.0.3) and github.com/nats-io/nats-server/v2 (v2.5.0) are affected by CVE-2021-3127 & CVE-2022-24450 in that this project got flagged by security scans. Both of these libs at their current version require nats-io/jwt v1.2.2 or nats-io/jwt/v2 v2.0.3 (which itself requires nats-io/jwt v1.2.2) and are both affected by CVE-2021-3127. nats-io/nats-server/v2 >= 2.7.2 patches CVE-2022-24450

TheoBrigitte commented 1 year ago

Hitting following CVEs from security scan report : CVE-2022-24450 and CVE-2022-29946.

The linked PR solves those.