Current version of https://github.com/nats-io/jwt/v2 (v2.0.3) and github.com/nats-io/nats-server/v2 (v2.5.0) are affected by CVE-2021-3127 & CVE-2022-24450 in that this project got flagged by security scans. Both of these libs at their current version require nats-io/jwt v1.2.2 or nats-io/jwt/v2 v2.0.3 (which itself requires nats-io/jwt v1.2.2) and are both affected by CVE-2021-3127. nats-io/nats-server/v2 >= 2.7.2 patches CVE-2022-24450
This PR updates nats-io/jwt/v2 to v2.2.0 and nats-io/nats-server/v2 to v2.8.4 patches CVE-2021-3127 & CVE-2022-24450.
Issue: #1236
Current version of
https://github.com/nats-io/jwt/v2(v2.0.3) andgithub.com/nats-io/nats-server/v2(v2.5.0) are affected byCVE-2021-3127&CVE-2022-24450in that this project got flagged by security scans. Both of these libs at their current version requirenats-io/jwt v1.2.2ornats-io/jwt/v2 v2.0.3(which itself requiresnats-io/jwt v1.2.2) and are both affected byCVE-2021-3127.nats-io/nats-server/v2>= 2.7.2 patchesCVE-2022-24450This PR updates
nats-io/jwt/v2tov2.2.0andnats-io/nats-server/v2tov2.8.4patchesCVE-2021-3127&CVE-2022-24450. Issue: #1236