search

krakend / krakend-jose

Javascript Object Signing and Encryption (JOSE) component for the KrakenD framework
http://www.krakend.io
Apache License 2.0
33 stars 49 forks source link

replace go-jose.v2 with newer version because it is vulnerable to CVE-2024-28180 #134

Open gunturaf opened 3 months ago

gunturaf commented 3 months ago

Based on the advisory in this link, the go-jose.v2 is vulnerable: https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g

I tried to fix in my local clone of krakend-jose, but it seems that the underlying dependency of go-auth0 also needs to be updated.

I might be able to send MRs for both of the repositories affected, but in this issue I just want to let you folks know that this vuln might be blocking some organizations that uses trivy in their CI/CD pipeline.

alombarte commented 3 months ago

Thanks @gunturaf. Generally speaking, trivy is an excellent tool but it also gives a lot of false positives, so blocking your pipelines because of it IMHO is a drastic measure and not an advisable strategy.

That being said, KrakenD does not support JWE, and while this vulnerability is on the JOSE package, it does not affect KrakenD. Feel free to open MR for review, but I must warn you that the go-auth0 will be "challenging".